yt-dlp improperly sanitizes file extensions of downloaded files, allowing arbitrary filenames including executables to be created in the download folder. On Windows, this can lead to path traversal and execution of malicious executables or configuration files (e.g., yt-dlp.conf) containing commands. The vulnerability is addressed in yt-dlp version 2024.07.01 by implementing a whitelist of allowed file extensions, reducing the attack surface. Exploitation involves tricking yt-dlp into downloading files with dangerous extensions such as .exe or .conf, which can then be executed on subsequent runs.

An attacker can cause yt-dlp to create files with arbitrary names and extensions in the download directory, including executables or configuration files. This can lead to arbitrary code execution when yt-dlp is run again, especially on Windows systems where executables in the working directory are executed. The impact includes full compromise of the user environment running yt-dlp.

A fix is available in yt-dlp version 2024.07.01, which should be applied promptly. Users should always include '.%(ext)s' at the end of output templates and avoid downloading to directories in the system PATH or other sensitive locations. For those unable to upgrade immediately, restrict downloads to common media extensions, avoid generic extractors, use default output templates, omit subtitle options, and avoid loading configuration files from common locations using '--ignore-config --config-location ...'.