The yt-dlp tool had a vulnerability (CVE-2026-50023) that allowed attackers to write arbitrary OS-shortcut files such as .desktop, .url, and .webloc by exploiting the inclusion of these extensions in the file extension allowlist intended for the --write-link option. Attackers can craft malicious m3u8 manifests with subtitle URIs pointing to files with these extensions, causing yt-dlp to write malicious shortcut files when options like --write-subs are used. These shortcut files can execute shell commands or point to remote executables, posing a risk of social engineering and code execution. The vulnerability bypasses the previous fix for CVE-2024-38519. The issue is resolved in yt-dlp version 2026.06.09 by restricting these extensions to the --write-link context only.

Successful exploitation allows remote attackers to write malicious OS-shortcut files to the user's filesystem, which can be disguised as subtitle or media files. Because shortcut file extensions are often hidden, users may be tricked into executing malicious shortcuts, leading to phishing attacks or arbitrary code execution. The vulnerability has a high impact on confidentiality, integrity, and availability as indicated by a CVSS score of 8.3.

A patch is available in yt-dlp version 2026.06.09 that removes .desktop, .url, and .webloc from the global file extension allowlist and restricts their use to the --write-link option context. Users should upgrade to this version immediately. If upgrading is not possible, users must only pass fully trusted URLs to yt-dlp, avoid using options --write-subs, --write-auto-subs, --embed-subs, --write-thumbnail, --write-all-thumbnails, and --embed-thumbnail, and use --format - to manually select and validate download formats.