Threats tagged 'brew-scdl-cve-2026-50023'

A vulnerability in yt-dlp allows attackers to write arbitrary OS-shortcut files (.desktop, .url, .webloc) to the user's filesystem by bypassing the previous fix for CVE-2024-38519. This occurs because the allowlist for file extensions included unsafe shortcut extensions to preserve functionality, which can be exploited via crafted media manifests. The malicious shortcut files can deceive users into executing arbitrary commands or phishing attacks. The issue is fixed in yt-dlp version 3.0.6.