CVE-2026-71212

xidown (a yt-dlp/ffmpeg GUI wrapper) constructs its yt-dlp command by appending a user-supplied URL as a bare trailing positional argument, with no end-of-options marker (-- or scheme validation). Because yt-dlp treats any argument starting with '-' as an option, a crafted URL such as -U or --exe...

FFmpeg-SDK command injection vulnerability

ffmpeg-sdk is a ffmpeg wrapper for nodejs by the individual developer Shajan Jacob in India. A security vulnerability exists in ffmpeg-sdk, which stems from the vulnerability of index.js to command injection attacks...