Read the docs
TI-2024-14996 Aliases CVE-2024-22423GHSA-hjq6-52gw-2g7p

yt-dlp `--exec` command injection when using `%q` in yt-dlp on Windows

Priority MEDIUM 45CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using `--exec` with `%q` by replacing double quotes with two double quotes. However, this escaping is not sufficient, and still allows expansion of environment variables. Support for output template expansion in `--exec`, along with this vulnerable behavior, was added to `yt-dlp` in version 2021.04.11. yt-dlp version 2024.04.09 fixes this issue by properly escaping `%`. It replaces them with `%%cd:~,%`, a variable that expands to nothing, leaving only the leading percent. It is recommended to upgrade yt-dlp to version 2024.04.09 as soon as possible. Also, always be careful when using `--exec`, because while this specific vulnerability has been patched, using unvalidated input in shell commands is inherently dangerous. For Windows users who are not able to upgrade, avoid using any output template expansion in `--exec` other than `{}` (filepath); if expansion in `--exec` is needed, verify the fields you are using do not contain `"`, `|` or `&`; and/or instead of using `--exec`, write the info json and load the fields from it instead.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0143 73rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed yt-dlp (yt-dlp): 2024.04.09yt-dlp (PyPI): 2024.04.09

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
yt-dlpyt-dlp2021.04.11 to before 2024.04.092024.04.09Patch availableCNA
—yt-dlp (PyPI)2021.04.11 to before 2024.04.092024.04.09Patch availableGHSA-hjq6-52gw-2g7p
  • yt-dlp Vendoryt-dlp Affected 2021.04.11 to before 2024.04.09 Fixed in 2024.04.09 Patch available CNA
  • yt-dlp (PyPI) Vendor— Affected 2021.04.11 to before 2024.04.09 Fixed in 2024.04.09 Patch available GHSA-hjq6-52gw-2g7p

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:yt-dlp_project:yt-dlp:*:*:*:*:*:*:*:*2021.04.11 to before 2024.04.09Vulnerableyt-dlp
  • cpe:2.3:a:yt-dlp_project:yt-dlp:*:*:*:*:*:*:*:* Versions 2021.04.11 to before 2024.04.09 Vulnerable ·yt-dlp

Remediation

  • Fix · CNA yt-dlp (yt-dlp) Fixed in 2024.04.09
  • Fix · GHSA-hjq6-52gw-2g7p yt-dlp (PyPI) Fixed in 2024.04.09 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-22423
  2. 2026-10-03 Alias added: GHSA-hjq6-52gw-2g7p

References

Exploit 1

Patch 2

Advisory 2

Other 4

  • TI-2024-03325 Command injection vulnerability in programing languages on Microsoft Windows operating system. CVSS 3.1CRITICAL 9.8
  • TI-2026-36849 yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519) CVSS 3.1CRITICAL 9.6
  • TI-2025-33915 yt-dlp allows `--exec` command injection when using placeholder on Windows CVSS 3.1HIGH 8.1
  • TI-2026-21287 yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option CVSS 3.1HIGH 8.8
  • TI-2026-37295 yt-dlp: Arbitrary code execution via manifest downloads with aria2c CVSS 3.1CRITICAL 9.6
  • TI-2026-39974 yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output CVSS 3.1HIGH 8.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences