CVE-2025-66203 — AI Deep Analysis Summary

🚨 **Essence**: StreamVault suffers from **OS Command Injection**. 📉 **Consequences**: Attackers can achieve **Remote Code Execution (RCE)** by exploiting unvalidated `yt-dlp` parameters.…

🛡️ **Root Cause**: **CWE-78** (Improper Neutralization of Special Elements used in an OS Command). 🐛 **Flaw**: The application does not sufficiently validate or sanitize parameters passed to the `yt-dlp` subprocess.…

👥 **Affected**: Users of **StreamVault** by developer **lemon8866**. 📦 **Version**: All versions **prior to 251126**. 🚫 Version **251226** and later are the patched releases. ⚠️ Personal video parsing/download tool.

💻 **Privileges**: Full **Remote Code Execution**. 📂 **Data**: Complete compromise of the host system. 📊 **Impact**: High Confidentiality, Integrity, and Availability impact (CVSS H).…

🔑 **Auth Required**: **Yes**. The vector indicates **PR:L** (Privileges Required: Low). 🌐 **Access**: Network-accessible (**AV:N**). 🚪 **UI**: No user interaction needed (**UI:N**). 📉 **Complexity**: Low (**AC:L**).…

🚫 **Public Exploit**: **No**. The `pocs` field is empty. 📰 **References**: Only official GitHub release notes and security advisories are linked.…

🔍 **Self-Check**: Verify your StreamVault version number. 📅 If it is **before 251126**, you are vulnerable. 🛠️ **Scanning**: Look for the `yt-dlp` integration in the tool's code or configuration.…

✅ **Fixed**: **Yes**. 📦 **Patch**: Released in version **251226**. 🔗 **Source**: GitHub Release [251226] and Security Advisory [GHSA-c747-q388-3v6m].…

🚧 **Workaround**: If you cannot update, **disable** the `yt-dlp` functionality if possible.…

🔥 **Urgency**: **HIGH**. 🚨 **Priority**: Patch immediately. 📉 **CVSS**: High severity (H:H:H).…