A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
### Summary
yt-dlp's `--exec` option is vulnerable to arbitrary command injection when handling untrusted metadata if the argument uses standard string formatting (e.g. `%(title)s`) or other unsafe conversions. An attacker could achieve remote code execution on the user's machine via maliciously crafted metadata containing quotes or other special shell characters.
### Details
Since yt-dlp version 2021.04.11, the `--exec` option has supported "output template syntax", which is a superset of Python's `printf`-style string formatting also used by the `--output` option. This means the user is able to pass a "command template" as an argument to the `--exec` option which will be executed by the user's shell. The command template allows for the downloaded video's metadata to be interpolated into the command string.
yt-dlp implements a `%()q` conversion, which will shell-quote/escape any metadata value such that it is safe to be interpolated into a command string. However, there are unsafe conversions such as `%()s` which result in the command template being formatted with the raw metadata string. These unsafe conversions do not perform any sanitization or escaping for shell contexts. If one or more of these unsafe conversions is used in the command template, an attacker can craft a malicious metadata value containing shell operators (e.g. `;`, `&`, `|`) to break out of the intended command and execute payload commands.
### Impact
The impact is limited to users who pass an `--exec` command template containing unsafe conversions in their yt-dlp command or configuration file: `%()s`, `%()a`, `%()r`, `%()j`, `%()S` (including any of their flagged variants.)
### Patches
yt-dlp version 2026.06.09 fixes this issue by restricting the conversions that can be used in an `--exec` command template to those known to be safe: `%()d`, `%()i`, `%()f`, `%()q` (including any of their flagged variants.) It also restricts the characters that can be used in command template defaults and placeholders when the user passes an `--exec` argument containing output template syntax.
### Workarounds
This vulnerability can be fully mitigated by doing any of the following:
- Upgrade yt-dlp to version 2026.06.09 or later
- Only use safe conversions (e.g. `%()d`, `%()i`, `%()f`, `%()q`) in any `--exec` command templates
- Do not use "output template syntax" in any `--exec` arguments
- Do not use the `--exec` option
### Proof-of-Concept
1. An attacker sets the title of a video to a malicious payload, e.g.: `video; touch pwned.txt #`
2. The victim downloads this video using yt-dlp with the `--exec` flag.
Reproduction steps (simulated):
1. Create a python script poc.py to simulate the internal behavior:
```bash
import unittest
import os
from yt_dlp.postprocessor.exec import ExecPP
from yt_dlp.YoutubeDL import YoutubeDL
from yt_dlp.utils import PostProcessingError
# Import Popen to use the REAL one for the PoC (to actually create the file)
from yt_dlp.utils import Popen as RealPopen
class TestDemonstrativePoC(unittest.TestCase):
FILE_NAME = "PWNED.txt"
def setUp(self):
# Remove the file if it exists
if os.path.exists(self.FILE_NAME):
os.remove(self.FILE_NAME)
def test_1_demonstrate_vulnerability_simulated(self):
"""
Simulates the code BEFORE the fix to show what would happen.
"""
print("\n--- TEST 1: Simulating vulnerable state ---")
# 1. Define the vulnerable Parse Method
def vulnerable_parse_cmd(self, cmd, info):
# This mimics the code before my patch
tmpl, tmpl_dict = self._downloader.prepare_outtmpl(cmd, info)
if tmpl_dict:
return self._downloader.escape_outtmpl(tmpl) % tmpl_dict
return cmd
# 2. Patch the class temporarily
original_parse_cmd = ExecPP.parse_cmd
ExecPP.parse_cmd = vulnerable_parse_cmd
info = {
'id': '1234',
# MALICIOUS TITLE:
# 1. 'video' gets echoed
# 2. ; separator
# 3. touch PWNED.txt creates the file
# 4. # comments out the rest
'title': f'video; touch {self.FILE_NAME} #',
'ext': 'mp4',
'filepath': 'video.mp4'
}
ydl = YoutubeDL({'verbose': False, 'quiet': True})
try:
print(f"[*] Payload Title: {info['title']}")
print("[*] Executing: echo %(title)s")
# Use the REAL Popen to actually execute shell commands
import yt_dlp.postprocessor.exec
original_popen_ref = yt_dlp.postprocessor.exec.Popen
yt_dlp.postprocessor.exec.Popen = RealPopen
pp = ExecPP(ydl, 'echo %(title)s')
pp.run(info)
# Restore Popen ref
yt_dlp.postprocessor.exec.Popen = original_popen_ref
# Check if file was created
if os.path.exists(self.FILE_NAME):
print(f"[!] VULNERABIL
### Impact
yt-dlp's DouyuTV and DouyuShow extractors used a `cdn.bootcdn.net` URL as a fallback for fetching a component of the crypto-js JavaScript library. When the Douyu extractor is used, yt-dlp extracts this JavaScript code and attempts to execute it externally using [PhantomJS](https://github.com/ariya/phantomjs). `bootcdn.net` is owned by the bad actor responsible for the [Polyfill JS supply chain attack](https://sansec.io/research/polyfill-supply-chain-attack) that has been ongoing since at least June 2023. While there is no evidence that PhantomJS has been targeted by or is vulnerable to any attacks carried out by the Polyfill JS actor, there is the possibility that malicious JavaScript code may have been downloaded/cached by yt-dlp or executed by PhantomJS.
In order for this potential vulnerability to be exploited by any hypothetical attack, all 3 of the following conditions must be met:
1. The user has PhantomJS installed on their system.
2. The user passes a `douyu.com` or `douyutv.com` URL to yt-dlp as input, or passes a URL that redirects to one of these domains.
3. `cdnjs.cloudflare.com` is unavailable or blocked at the time of extraction, necessitating the usage of the `cdn.bootcdn.net` fallback; or it had been unavailable during a previous run of the Douyu extractor and JavaScript code from `cdn.bootcdn.net` had been cached to disk.
### Patches
yt-dlp version 2024.07.07 fixes this issue by removing the URL pointing to the malicious CDN and by invalidating any Douyu extractor cache data created by unpatched versions of yt-dlp.
### Workarounds
It is recommended to upgrade yt-dlp to version 2024.07.07 as soon as possible.
For users not able to upgrade:
- Avoid using the Douyu extractors (`--ies default,-douyutv,-douyushow`)
- Uninstall (or do not install) PhantomJS
### Acknowledgement
Thanks to @LeSuisse for [reporting this](https://github.com/yt-dlp/yt-dlp/pull/10347) promptly after `bootcdn.net` was discovered to be under control of the same bad actor behind the `polyfill.io` supply chain attack.
### References
- https://github.com/yt-dlp/yt-dlp/commit/6075a029dba70a89675ae1250e7cdfd91f0eba41
- https://sansec.io/research/polyfill-supply-chain-attack
yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.
yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp. This vulnerability is fixed in 2026.06.09.
yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519. The allowlist explicitly included the unsafe extensions .desktop, .url, and .webloc so that the functionality of the --write-link option (and its variants) could be preserved. These allowlist inclusions can be exploited by an attacker to write malicious OS-shortcut files in the context of a media or subtitles download. This vulnerability is fixed in 2026.06.09.
yt-dlp is a command-line audio/video downloader. From 2023.09.24 until 2026.06.09, if curl is used as an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. At the file download stage, the cookies are passed by yt-dlp to the file downloader via --cookie. However, unless these are loaded from a file, this operation does not activate the cookie engine. As a result, curl will send cookies with requests to domains or paths for which the cookies are not scoped. This vulnerability is fixed in 2026.06.09.
yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter) is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously crafted URL. yt-dlp maintainers assume the impact of this vulnerability to be high for anyone who uses `--netrc-cmd` in their command/configuration or `netrc_cmd` in their Python scripts. Even though the maliciously crafted URL itself will look very suspicious to many users, it would be trivial for a maliciously crafted webpage with an inconspicuous URL to covertly exploit this vulnerability via HTTP redirect. Users without `--netrc-cmd` in their arguments or `netrc_cmd` in their scripts are unaffected. No evidence has been found of this exploit being used in the wild. yt-dlp version 2026.02.21 fixes this issue by validating all netrc "machine" values and raising an error upon unexpected input. As a workaround, users who are unable to upgrade should avoid using the `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter), or they should at least not pass a placeholder (`{}`) in their `--netrc-cmd` argument.
Scrapy versions up to 2.13.3 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of available memory. This occurs because brotli can achieve extremely high compression ratios for zero-filled data, leading to excessive memory consumption during decompression. Mitigation for this vulnerability needs security enhancement added in brotli v1.2.0.
`yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows). Since `yt-dlp` and `youtube-dl` also read config from the working directory (and on Windows executables will be executed from the `yt-dlp` or `youtube-dl` directory), this could lead to arbitrary code being executed.
`yt-dlp` version 2024.07.01 fixes this issue by whitelisting the allowed extensions. `youtube-dl` fixes this issue in commit `d42a222` on the `master` branch and in nightly builds tagged 2024-07-03 or later. This might mean some very uncommon extensions might not get downloaded, however it will also limit the possible exploitation surface. In addition to upgrading, have `.%(ext)s` at the end of the output template and make sure the user trusts the websites that they are downloading from. Also, make sure to never download to a directory within PATH or other sensitive locations like one's user directory, `system32`, or other binaries locations. For users who are not able to upgrade, keep the default output template (`-o "%(title)s [%(id)s].%(ext)s`); make sure the extension of the media to download is a common video/audio/sub/... one; try to avoid the generic extractor; and/or use `--ignore-config --config-location ...` to not load config from common locations.
yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using `--exec` with `%q` by replacing double quotes with two double quotes. However, this escaping is not sufficient, and still allows expansion of environment variables. Support for output template expansion in `--exec`, along with this vulnerable behavior, was added to `yt-dlp` in version 2021.04.11. yt-dlp version 2024.04.09 fixes this issue by properly escaping `%`. It replaces them with `%%cd:~,%`, a variable that expands to nothing, leaving only the leading percent. It is recommended to upgrade yt-dlp to version 2024.04.09 as soon as possible. Also, always be careful when using `--exec`, because while this specific vulnerability has been patched, using unvalidated input in shell commands is inherently dangerous. For Windows users who are not able to upgrade, avoid using any output template expansion in `--exec` other than `{}` (filepath); if expansion in `--exec` is needed, verify the fields you are using do not contain `"`, `|` or `&`; and/or instead of using `--exec`, write the info json and load the fields from it instead.