Loading vulnerability…
Authenticated OS Command Injection in StreamVault yt-dlp Configuration
CVE-2025-66203 is an OS command injection vulnerability in StreamVault versions before 251126, affecting the SpiritApplication component. The administrative configuration endpoint permits administrators to save yt-dlp arguments without sufficient validation. Those globally stored arguments are later incorporated by YtDlpUtil.java when constructing a command line that executes yt-dlp, enabling injected arguments to reach command execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated administrator can achieve remote code execution through malicious yt-dlp arguments processed by the application.
If you can’t patch tonight, do this now.
Restrict administrative access to trusted personnel, monitor and audit usage of the /admin/api/saveConfig endpoint, and consider network segmentation to limit exposure. Employ application-level input validation and command execution controls where possible.
Patch, then assume compromise.
Upgrade StreamVault to version 251126 or later, which patches the vulnerability.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.