CVE-2025-66203

Critical · CVSS 9.9

CVSS: 9.9; nvd
EPSS: 0.78%; 55th pct
KEV: No
Class: oss containerizable; CWE-78

Description

StreamVault is a video download integration solution. Prior to version 251126, a Remote Code Execution (RCE) vulnerability exists in the stream-vault application (SpiritApplication). The application allows administrators to configure yt-dlp arguments via the /admin/api/saveConfig endpoint without sufficient validation. These arguments are stored globally and subsequently used in YtDlpUtil.java when constructing the command line to execute yt-dlp. This issue has been patched in version 251126.

References

https://github.com/lemon8866/StreamVault/releases/tag/251226
https://github.com/lemon8866/StreamVault/security/advisories/GHSA-c747-q388-3v6m

Status: profiled · ingested 2026-10-06T00:00:53.000Z