xidown, a GUI wrapper for yt‑dlp/ffmpeg, constructs the yt‑dlp command line by appending a user‑supplied URL as a bare trailing positional argument without an end‑of‑options marker or scheme validation. If a malicious input begins with a dash, yt‑dlp interprets it as an option, creating an argument injection vector. This flaw allows an attacker to alter yt‑dlp’s execution flow by injecting arbitrary options, though no proof of successful code execution has been demonstrated. The risk is primarily theoretical but could be significant if the wrapper is exposed to untrusted input.

The affected product is xidown, distributed by indravoyager. No specific version information is provided in the CVE entry, so all releases of xidown remain potentially vulnerable until a patch is released.

The CVSS score of 4.4 indicates moderate severity. Because the EPSS score is 0.00131 (< 1%) and the CVE is not listed in KEV, the current exploit probability is very low but not zero. The attack vector is inferred to be local or remote if xidown is exposed to untrusted input. Even though no successful code execution demonstration exists, the existing argument‑injection primitive could still be abused in future releases or in combination with other vulnerabilities.