Yewtube: yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp
yt-dlp's --exec option is vulnerable to arbitrary command injection when unsafe string formatting conversions are used in the command template. This allows an attacker to execute arbitrary shell commands via maliciously crafted video metadata. The vulnerability affects users who use unsafe conversions like %()s in --exec templates. yt-dlp 2026.06.09 fixes this by restricting allowed conversions to safe ones and limiting characters in templates. Users can mitigate by upgrading or avoiding unsafe conversions or the --exec option altogether.
AI Analysis
Technical Summary
Since yt-dlp version 2021.04.11, the --exec option supports output template syntax allowing metadata interpolation into shell commands. Unsafe conversions such as %()s do not sanitize metadata, enabling command injection if malicious metadata contains shell operators. This can lead to remote code execution on the user's machine. yt-dlp 2026.06.09 restricts allowed conversions in --exec templates to safe ones (%()d, %()i, %()f, %()q) and limits characters in templates to prevent injection. The vulnerability only affects users who use unsafe conversions in --exec templates.
Potential Impact
An attacker can achieve remote code execution on the victim's machine if the victim uses yt-dlp with the --exec option containing unsafe conversions and downloads media with malicious metadata. The impact is limited to users who use unsafe conversions in --exec command templates. This can lead to arbitrary command execution with the privileges of the user running yt-dlp.
Mitigation Recommendations
A fix is available in yt-dlp version 2026.06.09 which restricts --exec conversions to safe ones and limits characters in command templates. Users should upgrade to 2026.06.09 or later. Alternatively, users can mitigate by only using safe conversions (%()d, %()i, %()f, %()q) in --exec templates, avoid using output template syntax in --exec, or avoid using the --exec option entirely.
Yewtube: yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp
Description
yt-dlp's --exec option is vulnerable to arbitrary command injection when unsafe string formatting conversions are used in the command template. This allows an attacker to execute arbitrary shell commands via maliciously crafted video metadata. The vulnerability affects users who use unsafe conversions like %()s in --exec templates. yt-dlp 2026.06.09 fixes this by restricting allowed conversions to safe ones and limiting characters in templates. Users can mitigate by upgrading or avoiding unsafe conversions or the --exec option altogether.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Since yt-dlp version 2021.04.11, the --exec option supports output template syntax allowing metadata interpolation into shell commands. Unsafe conversions such as %()s do not sanitize metadata, enabling command injection if malicious metadata contains shell operators. This can lead to remote code execution on the user's machine. yt-dlp 2026.06.09 restricts allowed conversions in --exec templates to safe ones (%()d, %()i, %()f, %()q) and limits characters in templates to prevent injection. The vulnerability only affects users who use unsafe conversions in --exec templates.
Potential Impact
An attacker can achieve remote code execution on the victim's machine if the victim uses yt-dlp with the --exec option containing unsafe conversions and downloads media with malicious metadata. The impact is limited to users who use unsafe conversions in --exec command templates. This can lead to arbitrary command execution with the privileges of the user running yt-dlp.
Mitigation Recommendations
A fix is available in yt-dlp version 2026.06.09 which restricts --exec conversions to safe ones and limits characters in command templates. Users should upgrade to 2026.06.09 or later. Alternatively, users can mitigate by only using safe conversions (%()d, %()i, %()f, %()q) in --exec templates, avoid using output template syntax in --exec, or avoid using the --exec option entirely.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-yewtube-GHSA-69qj-pvh9-c5wg
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6aac8e6e55bf5e2cf5491ed0
Added to database: 09/18/2026, 01:05:50 UTC
Last enriched: 09/18/2026, 01:56:36 UTC
Last updated: 09/18/2026, 02:01:24 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.