A vulnerability in YtGrabber-TUI allows a local attacker to achieve arbitrary code execution by exploiting improper file link resolution during the invocation of external utilities.

This flaw involves improper link resolution (CWE-59), where the application allows the configuration of a path to the yt-dlp executable. An attacker with local write access to the configuration file or the filesystem can replace the binary or use a symbolic link to trigger malicious code execution under the privileges of the user running the application.

Successful exploitation permits a local attacker to execute arbitrary commands with the privileges of the user running the application, leading to a complete compromise of the local environment. Given the CVSS score of 7.8, this represents a significant risk to the integrity and confidentiality of the host system, especially if the application is run by users with elevated permissions.

Immediate Action: Update the YtGrabber-TUI application to version 1.0-rc or later immediately to resolve the vulnerable file handling mechanism.

Proactive Monitoring: Monitor system logs for unexpected execution of binaries from non-standard paths or unauthorized modifications to configuration files associated with YtGrabber-TUI.

Compensating Controls: Ensure that the configuration files for the application are protected with strict filesystem permissions, limiting write access to only the authorized user account.

Public Exploit Available: Unknown

This vulnerability presents a high risk to local system security by enabling arbitrary code execution. Organizations should prioritize upgrading to version 1.0-rc as the primary mitigation, as it addresses the core logic error in file path resolution. Until the update is applied, maintain strict access controls on the application configuration files to prevent unauthorized modification.