CVE-2026-71212

xidown (a yt-dlp/ffmpeg GUI wrapper) constructs its yt-dlp command by appending a user-supplied URL as a bare trailing positional argument, with no end-of-options marker (-- or scheme validation). Because yt-dlp treats any argument starting with '-' as an option, a crafted URL such as -U or --exe...