From 8bfb89c29b61b9b13608744fbfec18e85c271f69 Mon Sep 17 00:00:00 2001
From: Sebastion <sebastion@sebastion.dev>
Date: Fri, 24 Jul 2026 09:47:09 +0100
Subject: [PATCH] fix: prevent yt-dlp option injection via videoUrl

---
 src/Fetcher.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Fetcher.ts b/src/Fetcher.ts
index 256bdfd..fcef36f 100644
--- a/src/Fetcher.ts
+++ b/src/Fetcher.ts
@@ -217,7 +217,7 @@ export class Fetcher {
           "--sub-format", "srv1",
           "--skip-download",
           "-o", `${tmpDir}/sub`,
-          videoUrl,
+          "--", videoUrl,
         ],
         { encoding: "utf-8", timeout: 30000, stdio: ["pipe", "pipe", "pipe"] },
       );