Moodle dl: yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp
yt-dlp's --exec option is vulnerable to arbitrary command injection if unsafe string formatting conversions are used in the command template. This allows an attacker to inject shell commands via maliciously crafted video metadata. The vulnerability affects users who use unsafe conversions like %()s in their --exec templates. A fix is available in yt-dlp version 2026.06.09 that restricts allowed conversions to safe ones and limits characters in command templates.
AI Analysis
Technical Summary
Since yt-dlp version 2021.04.11, the --exec option supports output template syntax allowing metadata interpolation in shell commands. Unsafe conversions such as %()s do not sanitize metadata, enabling command injection if malicious metadata contains shell operators. This can lead to remote code execution on the user's machine. The vulnerability is limited to users employing unsafe conversions in --exec command templates. yt-dlp 2026.06.09 restricts allowed conversions to safe ones (%()d, %()i, %()f, %()q) and restricts characters in command templates to prevent injection.
Potential Impact
An attacker can achieve remote code execution on a user's machine if the user runs yt-dlp with the --exec option using unsafe string formatting conversions and downloads a video with maliciously crafted metadata. The impact is limited to users who use unsafe conversions in --exec templates. This can lead to full compromise of the user's environment where yt-dlp is run.
Mitigation Recommendations
A fix is available in yt-dlp version 2026.06.09 that restricts allowed conversions in --exec command templates to safe ones and limits characters to prevent injection. Users should upgrade to this version or later. Alternatively, users can mitigate by only using safe conversions (%()d, %()i, %()f, %()q), not using output template syntax in --exec, or not using the --exec option at all.
Moodle dl: yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp
Description
yt-dlp's --exec option is vulnerable to arbitrary command injection if unsafe string formatting conversions are used in the command template. This allows an attacker to inject shell commands via maliciously crafted video metadata. The vulnerability affects users who use unsafe conversions like %()s in their --exec templates. A fix is available in yt-dlp version 2026.06.09 that restricts allowed conversions to safe ones and limits characters in command templates.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Since yt-dlp version 2021.04.11, the --exec option supports output template syntax allowing metadata interpolation in shell commands. Unsafe conversions such as %()s do not sanitize metadata, enabling command injection if malicious metadata contains shell operators. This can lead to remote code execution on the user's machine. The vulnerability is limited to users employing unsafe conversions in --exec command templates. yt-dlp 2026.06.09 restricts allowed conversions to safe ones (%()d, %()i, %()f, %()q) and restricts characters in command templates to prevent injection.
Potential Impact
An attacker can achieve remote code execution on a user's machine if the user runs yt-dlp with the --exec option using unsafe string formatting conversions and downloads a video with maliciously crafted metadata. The impact is limited to users who use unsafe conversions in --exec templates. This can lead to full compromise of the user's environment where yt-dlp is run.
Mitigation Recommendations
A fix is available in yt-dlp version 2026.06.09 that restricts allowed conversions in --exec command templates to safe ones and limits characters to prevent injection. Users should upgrade to this version or later. Alternatively, users can mitigate by only using safe conversions (%()d, %()i, %()f, %()q), not using output template syntax in --exec, or not using the --exec option at all.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-moodle-dl-GHSA-69qj-pvh9-c5wg
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6aac8e6455bf5e2cf5491e6f
Added to database: 09/18/2026, 01:05:40 UTC
Last enriched: 09/18/2026, 01:53:59 UTC
Last updated: 09/18/2026, 04:01:24 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.