CVE-2025-57799

Deeper analysis

StreamVault is a multi-platform video parsing and downloading tool that is affected by a command-injection vulnerability (CWE-78) in all versions prior to 250822. After an attacker logs into the StreamVault system, they can modify certain system parameters to construct and execute malicious commands, resulting in remote code execution that grants full server privileges. The issue is especially severe for deployments that retain default or weak background passwords, as these allow initial access without additional authentication barriers. The vulnerability carries a CVSS 4.0 score of 8.7 with network attack vector and high impact on confidentiality, integrity, and availability.

An authenticated attacker who obtains valid credentials can exploit the flaw remotely to achieve arbitrary command execution and full system takeover. Because the attack requires only low-privilege login and no user interaction, any exposed instance with unchanged default credentials is at immediate risk of compromise.

The official GitHub security advisory GHSA-qg4r-92hv-g9f4 and the patch commit 2e3f1f54b7d8a4e6389b640796866ac1108780ef state that the vulnerability has been fixed in version 250822; administrators are advised to update immediately and ensure background passwords are changed from defaults. The current EPSS score of 0.0126, with a peak of only 0.0144, indicates limited observed exploitation interest to date.