xidown, a GUI wrapper for yt‑dlp/ffmpeg, creates the yt‑dlp command line by appending the user‑supplied URL directly as a positional argument. Because no end‑of‑options marker or scheme validation is performed, a crafted ‘URL’ that begins with a dash is interpreted by yt‑dlp as a real command‑line option. This flaw can alter yt‑dlp’s execution flow and provides an attacker the ability to inject options such as --exec, potentially allowing arbitrary code execution. The CVE report confirms the injection primitive exists but does not demonstrate successful code execution in the single‑URL scenario; the risk therefore remains theoretical but non‑negligible. The vulnerability is a classic argument injection (CWE‑88). It could be exploited in any environment where xidown is run with user‑supplied URLs—particularly if the wrapper is exposed to untrusted input such as a web interface or shared network pipeline. The attacker would need to supply a malicious URL starting with a hyphen; the tool would then misinterpret the argument and execute yt‑dlp’s internal logic for that option. Given the CVSS score of 4.4, the impact is considered moderate. EPSS is not available, and the flaw is not listed in CISA’s KEV catalog. Without a proven exploit, the likelihood of real‑world attacks is uncertain, but the presence of an argument injection vector warrants immediate attention and cautious mitigation.

The affected product is xidown, distributed by indravoyager. No specific version information is provided in the CVE entry, so all releases of xidown remain potentially vulnerable until a patch is released.

The CVSS score of 4.4 indicates moderate severity. Because EPSS is not reported and the CVE is not in the KEV list, the current exploit probability is low but not zero. The attack vector is inferred to be local or remote if xidown is exposed to untrusted input. Even though full code execution via --exec was not demonstrated, the existing argument‑injection primitive could be abused in future releases or in combination with other vulnerabilities.