CVE-2026-6219

MediumCVSS 5.3

Published: 13/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.02%

63th percentile - higher than 63% of all known CVEs

Summary

In aandrew-me ytDownloader up to 3.20.2, the child_process.exec function in src/compressor.js (Compressor Feature component) allows command injection. The attack requires local access and the exploit has been publicly disclosed.

Risk Assessment

A local attacker could execute arbitrary commands in the application context, potentially compromising the user account or system.

Recommendation

Update ytDownloader to a version containing the fix and avoid processing untrusted media files.

Other vulnerabilities in ytDownloader

CVE-2026-6218Medium
A vulnerability was found in ytDownloader up to 3.20.2 in the createTextNode function of the Error Details Panel component, leading to cross-site scripting (XSS). The attack may be performed remotely. The vendor was contacted about this disclosure.

Original NVD description (English source)

A vulnerability was determined in aandrew-me ytDownloader up to 3.20.2. This affects the function child_process.exec of the file src/compressor.js of the component Compressor Feature. This manipulation causes command injection. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS