Threats affecting pkg:brew/scdl

yt-dlp's --exec option is vulnerable to arbitrary command injection when unsafe string formatting conversions are used in the command template with untrusted metadata. This allows an attacker to execute arbitrary shell commands by crafting malicious video metadata. The issue affects users who use unsafe conversions such as %()s in their --exec argument. A fix is available in yt-dlp version 2026.06.09 which restricts allowed conversions to safe ones and sanitizes inputs.

yt-dlp versions 3.0.0 through 3.0.6 have a vulnerability in the handling of shortcut files generated by the --write-link, --write-url-link, and --write-desktop-link options. Improper sanitization of metadata used in these shortcuts can lead to downstream command injection. On Windows, a malicious file:// URI in the webpage_url can cause execution of remote executables when the .url file is opened. On Linux, if the --no-windows-filenames option is used, unsanitized filenames with newline characters can inject arbitrary commands into .desktop files, leading to shell command execution when opened. This vulnerability is fixed in version 3.0.7.

A vulnerability in yt-dlp versions >=3.0.0 <3.0.6 allows arbitrary code execution via crafted manifest downloads when using aria2c as an external downloader. The flaw arises from insufficient sanitization of input passed to aria2c's input file, enabling attackers to inject arbitrary aria2c options and perform arbitrary file writes. On Windows, this can lead to immediate code execution; on other platforms, code execution can occur on subsequent yt-dlp runs. The issue is fixed in yt-dlp version 3.0.6.

A vulnerability in yt-dlp allows attackers to write arbitrary OS-shortcut files (.desktop, .url, .webloc) to the user's filesystem by bypassing the previous fix for CVE-2024-38519. This occurs because the allowlist for file extensions included unsafe shortcut extensions to preserve functionality, which can be exploited via crafted media manifests. The malicious shortcut files can deceive users into executing arbitrary commands or phishing attacks. The issue is fixed in yt-dlp version 3.0.6.

A vulnerability in yt-dlp when using curl as an external downloader can cause cookie leakage to unintended hosts during HTTP redirects or when download fragment hosts differ from their parent manifest. This occurs because cookies passed via command line do not activate curl's cookie engine, causing cookies to be sent to domains outside their scope. The issue affects yt-dlp versions from 3.0.0 up to but not including 3.0.6. Version 3.0.6 includes a fix that changes how cookies are passed to curl, preventing leakage.

yt-dlp versions >=3.0.0 <3.0.4 contain a high-severity vulnerability (CVE-2026-26331) involving arbitrary command injection via the `--netrc-cmd` option or `netrc_cmd` Python API parameter. This occurs when a maliciously crafted URL is processed, allowing shell command injection due to unsafe handling of the netrc "machine" value in certain extractors. The vulnerability is fixed in version 3.0.4.