CVE-2026-6219

MEDIUM5.3

aandrew-me ytDownloader Compressor Feature compressor.js child_process.exec command injection

Published Apr 13, 2026

Modified 1 weeks ago

Details

A vulnerability was determined in aandrew-me ytDownloader up to 3.20.2. This affects the function child_process.exec of the file src/compressor.js of the component Compressor Feature. This manipulation causes command injection. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

References

WEB

https://gist.github.com/ngocnn97/53a9f251d1cb99b1b8033e211407d1b1

DETECTION

https://github.com/ngocnn97/security-advisories/blob/main/YtDownloader_Command_Injection_PoC.mp4

ADVISORY

https://vuldb.com/submit/785843

ADVISORY

https://vuldb.com/submit/785844

WEB

https://vuldb.com/vuln/357140

WEB