CVE-2026-71212: 
Ffmpeg vulnerability analysis and mitigation

CVE-2026-71212 is an argument injection vulnerability in xidown, a GUI wrapper for yt-dlp and ffmpeg, that allows a local attacker to inject arbitrary yt-dlp command-line options via a crafted URL input. The vulnerability affects xidown versions up to and including 1.25.1.19, developed by indravoyager. It was published on August 5, 2026, and assigned a CVSS v3.1 base score of 4.4 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-88 (Improper Neutralization of Argument Delimiters in a Command — Argument Injection). In xidown/core/scanner.py and downloader.py, xidown constructs its yt-dlp command-line invocation by appending the user-provided or scanned URL as a bare trailing positional argument without a -- end-of-options marker and without any URL scheme validation. Because yt-dlp treats any argument beginning with - as a CLI option, a crafted input such as -U (yt-dlp's self-update flag) or --exec=<command> is interpreted as a real yt-dlp option rather than a URL, altering control flow before yt-dlp's own URL validation runs. While full code execution via --exec was not demonstrated in the single-URL flow tested, the argument-injection primitive is confirmed and unmitigated across all call sites (GitHub Advisory, CWE-88).

Successful exploitation allows a local user with no special privileges to inject arbitrary yt-dlp command-line options, potentially modifying tool behavior, triggering self-updates, writing unexpected files, or achieving code execution through options such as --exec. The integrity and availability impacts are rated low, with no confidentiality impact assessed under the current CVSS scoring. The attack is constrained to the local system and requires user interaction (e.g., a user must open or process a crafted URL within xidown) (GitHub Advisory, Feedly).

There is no evidence of a public proof-of-concept exploit or active in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD's SSVC assessment classifies exploitation as "none" and the attack as non-automatable. The EPSS score is approximately 0.13%, placing it in the 2nd percentile for exploitation likelihood within 30 days (GitHub Advisory, Feedly).

1. Identify target: Locate a system running xidown version ≤ 1.25.1.19 where a user is about to download media via the GUI or CLI interface.
2. Craft malicious URL input: Prepare a string beginning with - that maps to a yt-dlp CLI option, such as -U (triggers yt-dlp self-update) or --exec=<shell_command> (executes an arbitrary command after download).
3. Deliver crafted input: Provide the malicious string as the URL field in xidown — either directly via the GUI input box, via a scanned QR code or clipboard value, or through any other input path that feeds into scanner.py or downloader.py.
4. Trigger execution: When the user initiates a download, xidown appends the crafted string as a bare positional argument to the yt-dlp command without a -- separator, causing yt-dlp to parse it as a CLI option.
5. Achieve objective: Depending on the injected option, the attacker can trigger self-update (-U), alter output paths, or potentially execute arbitrary shell commands via --exec=<command> before yt-dlp's own URL validation runs (GitHub Advisory, CWE-88).

• Process: Unexpected yt-dlp child processes spawned with arguments beginning with - or --exec= rather than a valid URL; yt-dlp self-update processes (-U) triggered without user intent.
• Logs: Application or system logs showing yt-dlp invocations where the URL argument starts with a dash (e.g., -U, --exec=).
• File System: Unexpected files written to disk by yt-dlp's --exec or -o options; new or modified yt-dlp binaries if -U (self-update) was injected.
• Network: Outbound connections from the yt-dlp process to unexpected hosts (e.g., yt-dlp update servers or attacker-controlled infrastructure) not initiated by the user.

The vendor advisory recommends the following mitigations: (1) Insert a -- end-of-options marker before appending any user-provided URL to the yt-dlp command invocation in all call sites within scanner.py and downloader.py; (2) Add URL scheme validation to reject any input beginning with -; (3) Refactor command construction to use argument arrays rather than string concatenation, which prevents argument delimiter injection by design. As of the advisory publication date, no patched version number has been specified in the GitHub Advisory Database. Users should monitor the xidown repository for an updated release and avoid processing untrusted URLs in the interim (GitHub Advisory, CWE-88).