Read the docs
TI-2025-33915 Aliases CVE-2025-54072

yt-dlp allows `--exec` command injection when using placeholder on Windows

Priority HIGH 70CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder (or {}), insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the mitigation for CVE-2024-22423 where the default placeholder and {} were not covered by the new escaping rules. Windows users who are unable to upgrade should avoid using --exec altogether. Instead, the --write-info-json or --dump-json options could be used, with an external script or command line consuming the JSON output. This is fixed in version 2025.07.21.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0065 51st percentileScored 2026-11-07
Fix Fixed yt-dlp (yt-dlp): 2025.07.21

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
yt-dlpyt-dlpbefore 2025.07.212025.07.21Patch availableCNA
  • yt-dlp Vendoryt-dlp Affected before 2025.07.21 Fixed in 2025.07.21 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:yt-dlp_project:yt-dlp:*:*:*:*:*:*:*:*before 2025.07.21Vulnerableyt-dlp
  • cpe:2.3:a:yt-dlp_project:yt-dlp:*:*:*:*:*:*:*:* Versions before 2025.07.21 Vulnerable ·yt-dlp

Remediation

  • Fix · CNA yt-dlp (yt-dlp) Fixed in 2025.07.21

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54072
  2. 2026-10-23 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 1

Other 1

  • TI-2024-03325 Command injection vulnerability in programing languages on Microsoft Windows operating system. CVSS 3.1CRITICAL 9.8
  • TI-2026-36849 yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519) CVSS 3.1CRITICAL 9.6
  • TI-2024-14996 yt-dlp `--exec` command injection when using `%q` in yt-dlp on Windows CVSS 3.1CRITICAL 9.8
  • TI-2026-21287 yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option CVSS 3.1HIGH 8.8
  • TI-2026-37295 yt-dlp: Arbitrary code execution via manifest downloads with aria2c CVSS 3.1CRITICAL 9.6
  • TI-2026-39974 yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output CVSS 3.1HIGH 8.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences