Read the docs
TI-2026-36849 Aliases CVE-2026-50023GHSA-c6mh-fpjc-4pr3

yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)

Priority HIGH 76CWE-641Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519. The allowlist explicitly included the unsafe extensions .desktop, .url, and .webloc so that the functionality of the --write-link option (and its variants) could be preserved. These allowlist inclusions can be exploited by an attacker to write malicious OS-shortcut files in the context of a media or subtitles download. This vulnerability is fixed in 2026.06.09.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00665 52nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed yt-dlp (yt-dlp): 2026.06.09yt-dlp (PyPI): 2026.6.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
yt-dlpyt-dlpbefore 2026.06.092026.06.09Patch availableCNA
—yt-dlp (PyPI)before 2026.6.92026.6.9Patch availableGHSA-c6mh-fpjc-4pr3
  • yt-dlp Vendoryt-dlp Affected before 2026.06.09 Fixed in 2026.06.09 Patch available CNA
  • yt-dlp (PyPI) Vendor— Affected before 2026.6.9 Fixed in 2026.6.9 Patch available GHSA-c6mh-fpjc-4pr3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:yt-dlp_project:yt-dlp:*:*:*:*:*:*:*:*before 2026.06.09Vulnerableyt-dlp
  • cpe:2.3:a:yt-dlp_project:yt-dlp:*:*:*:*:*:*:*:* Versions before 2026.06.09 Vulnerable ·yt-dlp

Remediation

  • Fix · CNA yt-dlp (yt-dlp) Fixed in 2026.06.09
  • Fix · GHSA-c6mh-fpjc-4pr3 yt-dlp (PyPI) Fixed in 2026.6.9 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-50023
  2. 2026-10-03 Alias added: GHSA-c6mh-fpjc-4pr3

References

Exploit 1

Patch 1

Advisory 3

Other 5

  • TI-2024-03325 Command injection vulnerability in programing languages on Microsoft Windows operating system. CVSS 3.1CRITICAL 9.8
  • TI-2025-33915 yt-dlp allows `--exec` command injection when using placeholder on Windows CVSS 3.1HIGH 8.1
  • TI-2024-14996 yt-dlp `--exec` command injection when using `%q` in yt-dlp on Windows CVSS 3.1CRITICAL 9.8
  • TI-2026-21287 yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option CVSS 3.1HIGH 8.8
  • TI-2026-37295 yt-dlp: Arbitrary code execution via manifest downloads with aria2c CVSS 3.1CRITICAL 9.6
  • TI-2026-39974 yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output CVSS 3.1HIGH 8.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences