The vulnerability is a local command injection in the Compressor Feature of aandrew-me ytDownloader, achieved by manipulating the child_process.exec call in src/compressor.js. Attackers with local access can supply crafted input that is passed directly to the shell, leading to arbitrary command execution and full compromise of the affected system. This weakness is classified as OS Command Injection (CWE-77) and input validation flaw (CWE-74).

All installations of aandrew-me ytDownloader up to and including version 3.20.2 are affected; the issue resides in the compressor feature and is present in all releases prior to a patch that must be applied.

The CVSS score of 4.8 indicates moderate severity. The lack of an EPSS score and absence from the CISA KEV listing suggest that widespread exploitation is not yet documented, but the locally available command injection remains a significant risk for any user who can execute the application. Exploitation requires the attacker to have local user privileges or to compromise the system through another vector that grants local execution.