Critical · published December 27, 2025
🚨 A sneaky flaw in StreamVault’s configuration process opens the door wide for Remote Code Execution! 🔥 Think of it like a restaurant where patrons can write their own special orders without the chef checking the ingredients — some could request something totally bizarre or even dangerous! With this vulnerability, an attacker could craft a malicious script that gets executed on the server, potentially leading to data breaches, system manipulation, or even total control of the server. This is absolutely devastating for any organization using the application, as it puts sensitive data and infrastructure at serious risk!
Think of it like a restaurant where patrons can write their own special orders without the chef checking the ingredients — some could request something totally bizarre or even dangerous! This Remote Code Execution vulnerability arises because StreamVault does not properly validate yt-dlp arguments configured via the /admin/api/saveConfig endpoint, allowing attackers to inject harmful commands into the application.
With this vulnerability, an attacker could craft a malicious script that gets executed on the server, potentially leading to data breaches, system manipulation, or even total control of the server. This is absolutely devastating for any organization using the application, as it puts sensitive data and infrastructure at serious risk! To protect yourself, upgrade to version 251126 immediately to patch this vulnerability. Additionally, review and restrict access to the /admin/api/saveConfig endpoint, ensuring only trusted administrators can modify configurations. Regularly audit your application for similar vulnerabilities as well! You've got this! Stay vigilant, follow these steps, and you'll have your environment secure in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| lemon8866/streamvault | < 251126 | 251126 |