Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
StreamVault is a video download integration solution. Prior to version 251126, a Remote Code Execution (RCE) vulnerability exists in the stream-vault application (SpiritApplication). The application allows administrators to configure yt-dlp arguments via the /admin/api/saveConfig endpoint without sufficient validation. These arguments are stored globally and subsequently used in YtDlpUtil.java when constructing the command line to execute yt-dlp. This issue has been patched in version 251126.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔴 StreamVault, #OS Command Injection, #CVE-2025-66203 (Critical) https://dailycve.com/streamvault-os-command-injection-cve-2025-66203-critical/
Post summary
DailyCVE announces a critical OS command injection vulnerability (CVE‑2025‑66203) in StreamVault, but no exploit code, patches, or evidence of active exploitation are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | lemon8866 | streamvault | - | - | - |