yt-dlp's --exec option is vulnerable to arbitrary command injection when unsafe string formatting conversions are used in the command template with untrusted metadata. This allows an attacker to execute arbitrary shell commands by crafting malicious video metadata. The issue affects users who use unsafe conversions such as %()s in their --exec argument. A fix is available in yt-dlp version 2026.06.09 which restricts allowed conversions to safe ones and sanitizes inputs.