CVE-2025-66203

Critical

Description

StreamVault is a video download integration solution. Prior to version 251126, a Remote Code Execution (RCE) vulnerability exists in the stream-vault application (SpiritApplication). The application allows administrators to configure yt-dlp arguments via the /admin/api/saveConfig endpoint without sufficient validation. These arguments are stored globally and subsequently used in YtDlpUtil.java when constructing the command line to execute yt-dlp. This issue has been patched in version 251126.

SeverityCritical

CVSS9.9

Exploit probability—

ProductLemon8866 Streamvault

PublishedDec 27, 2025

First seenDec 27, 2025

Weakness typeCWE-78OS command injection

How to fix

Update

lemon8866 streamvault251126 or later

Affected products

Product	Affected versions	Fixed in
lemon8866 streamvault	v < 251126	251126

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.