Threat Intelligence Database

A command injection vulnerability exists in yt-dlp when using the `--netrc-cmd` option or `netrc_cmd` Python API parameter. This flaw allows an attacker to execute arbitrary shell commands on the user's system by supplying a maliciously crafted URL. The vulnerability affects yt-dlp versions prior to 2026.02.21. The issue arises because the netrc "machine" value, which can be influenced by certain extractors processing hostnames, is passed unsafely to a shell command executed with `shell=True`. The vulnerability is mitigated by yt-dlp version 2026.02.21, which validates netrc "machine" values to prevent injection. Users who do not use `--netrc-cmd` or `netrc_cmd` are not affected. No active exploitation has been observed in the wild.

A vulnerability in yt-dlp allows remote attackers to write arbitrary OS-shortcut files (.desktop, .url, .webloc) to the user's filesystem by bypassing the previous fix for CVE-2024-38519. This occurs because the allowlist for file extensions included unsafe shortcut file types to preserve functionality, which attackers can exploit via crafted media manifests. The malicious shortcut files can be disguised as subtitle or media files, potentially leading to social engineering attacks or arbitrary code execution. The issue is fixed in yt-dlp version 2026.06.09 by removing these extensions from the global allowlist except within the intended context. Users are advised to upgrade or apply strict usage restrictions if unable to update.

A vulnerability in yt-dlp when used with aria2c as an external downloader for fragmented manifest formats (HLS/DASH) allows attackers to inject arbitrary options into aria2c's input file. This can lead to arbitrary file writes and, on Windows, immediate arbitrary code execution. On other platforms, code execution can occur on subsequent yt-dlp invocations. The issue arises from insufficient sanitization of manifest data and metadata fields used in output templates. yt-dlp version 2026.06.09 removes support for aria2c with fragmented manifests to fix this issue.

yt-dlp's --exec option is vulnerable to arbitrary command injection if unsafe string formatting conversions are used in the command template. This allows an attacker to inject shell commands via maliciously crafted video metadata. The vulnerability affects users who use unsafe conversions like %()s in their --exec templates. A fix is available in yt-dlp version 2026.06.09 that restricts allowed conversions to safe ones and limits characters in command templates.

### Summary If curl is used an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. This is the equivalent to [GHSA-v8mc-9377-rwjj](<https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-v8mc-9377-rwjj>) for the `curl` downloader. The vulnerable behavior is present in [yt-dlp](https://github.com/yt-dlp/yt-dlp) released since 2023.09.24. ### Details At the file download stage, the cookies are passed by yt-dlp to the file downloader via `--cookie`. However, unless these are loaded from a file, this operation does not activate the cookie engine. As a result, `curl` will send cookies with requests to domains or paths for which the cookies are not scoped. An example of a potential attack scenario exploiting this vulnerability: 1. an attacker has crafted a malicious website with an embedded URL designed to be detected by yt-dlp as a video download. This embedded URL has the domain of a trusted site that the user has loaded cookies for, and conducts an [unvalidated redirect](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html) to a target URL. 2. yt-dlp extracts this URL and calculates the cookies which are then passed to `curl`. 3. the download URL redirects to a server controlled by the attacker, to which `curl` forwards the user's sensitive cookie information. ### Patches yt-dlp version 2026.06.09 fixes this issue by doing the following: - Pass the cookies through stdin via `--cookie -` if `curl` is version 7.59 or higher. - Pass the cookies via `--cookie /dev/fd/0` if the system supports this device file. - In all other cases create a temporary file, save the cookies and then pass via `--cookie <file>`. ### Workarounds It is recommended to upgrade yt-dlp to version 2026.06.09 as soon as possible. For users who are not able to upgrade: - Do not use `--downloader curl`.

### Summary If the `--write-link`, `--write-url-link` or `--write-desktop-link` options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the `.url` and `.desktop` shortcut files written by yt-dlp. This allows for malicious shell commands or malicious remote executables to run on the user's system if the user executes the generated `.url` or `.desktop` files. ### Details The expected result of yt-dlp's `--write-link`, `--write-url-link` and `--write-desktop-link` options is to write a shortcut file that points to the webpage URL for the content downloaded by yt-dlp. The `--write-url-link` option writes a `.url` shortcut file for Windows, the `--write-desktop-link` option writes a `.desktop` shortcut file for Linux, and the `--write-link` option may write a `.url` file or a `.desktop` file depending on the user's platform. There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files. #### Scenario 1: `file://` URI injection in Windows `.url` shortcut If a yt-dlp user passes the `--write-link` or `--write-url-link` option to generate a Windows `.url` file, the URL written to the shortcut file is sourced from the downloaded media's metadata--specifically, its `webpage_url` value. This value is commonly a normalized version of the input URL passed to yt-dlp by the user, but in some cases it may be extracted from untrusted web input. Validation of this `webpage_url` value is performed if it is fed back to yt-dlp as an input URL (e.g. via the `--load-info-json` option), but no validation is performed before it is output to a `.url` shortcut file. This lack of validation is exploitable by a remote attacker who crafts a malicious metadata payload such that the resulting `webpage_url` value is a `file://` URI. A malicious file URI could point to a remote executable, e.g. `file://example.org/pwned.exe`. If a Windows user double-clicks a `.url` file that points to this `webpage_url`, Windows will execute the malicious remote executable on the user's system. #### Scenario 2: Shell command injection in Linux `.desktop` shortcut The Linux `.desktop` file format is a more versatile than the Windows `.url` file format. It is defined by the freedesktop.org "desktop entry" file specification, and supports multiple types of shortcuts: a `Link` type for URLs, a `Directory` type for filesystem folders, and an `Application` type for programs or shell commands. yt-dlp outputs a desktop entry file of the `Link` type, using the template below: ```desktop [Desktop Entry] Encoding=UTF-8 Name=%(filename)s Type=Link URL=%(url)s Icon=text-html ``` The keys under the `[Desktop Entry]` group are separated by newlines, and the type of desktop entry is set by the value paired to the `Type` key. If a yt-dlp user passes the `--write-link` or `--write-desktop-link` option to generate a desktop entry file, in addition to the `webpage_url` value there is a `filename` value that is written to the shortcut file. By default, yt-dlp will sanitize the `filename` value: this sanitization includes replacing newlines with spaces and removing other control characters. However, the `--no-windows-filenames` option was modified in yt-dlp version 2024.12.23 to disable this default filename sanitization when used. If the user passes `--write-link` or `--write-desktop-link` together with `--no-windows-filenames` to yt-dlp, an unsanitized `filename` value can be written to the resulting desktop entry file. A remote attacker can exploit this lack of sanitization by crafting a malicious metadata payload such that the resulting `filename` value contains newline characters, which can be used to inject arbitrary groups, keys and values into the desktop entry output. Doing so allows the attacker to change the `Type` of the desktop entry to `Application` and achieve shell command injection. For example, an attacker-controlled website could serve a webpage with this maliciously crafted JSON-LD data: ```html <html> <script type="application/ld+json">{ "@context": "https://schema.org", "@type": "VideoObject", "name":"Stream\nType=Application\nExec=sh -c &quot;touch /tmp/pwned&quot;\n\n[newgroup]\nName=endtitle", "contentUrl": "https://example.org/video.mp4" }</script> </html> ``` Then, a yt-dlp user could try to download the legitimate video content from the page by running the following command: ```bash yt-dlp --write-desktop-link --no-windows-filenames "https://example.org/123" ``` Which would result in a desktop entry file containing a malicious shell command: ```desktop [Desktop Entry] Encoding=UTF-8 Name=Stream Type=Application Exec=sh -c "touch /tmp/pwned" [newgroup] Name=endtitle [123] Type=Link URL=%(url)s Icon=te