{"id":"CVE-2024-38519","published":"2024-07-02T13:47:36Z","modified":"2024-08-02T04:12:25Z","title":"yt-dlp and youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization","vendor":"yt-dlp","product":"yt-dlp","tier":"tail","description":{"text":"`yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows). Since `yt-dlp` and `youtube-dl` also read config from the working directory (and on Windows executables will be executed from the `yt-dlp` or `youtube-dl` directory), this could lead to arbitrary code being executed.\n\n\n\n\n`yt-dlp` version 2024.07.01 fixes this issue by whitelisting the allowed extensions. `youtube-dl` fixes this issue in commit `d42a222` on the `master` branch and in nightly builds tagged 2024-07-03 or later. This might mean some very uncommon extensions might not get downloaded, however it will also limit the possible exploitation surface. In addition to upgrading, have `.%(ext)s` at the end of the output template and make sure the user trusts the websites that they are downloading from. Also, make sure to never download to a directory within PATH or other sensitive locations like one's user directory, `system32`, or other binaries locations. For users who are not able to upgrade, keep the default output template (`-o \"%(title)s [%(id)s].%(ext)s`); make sure the extension of the media to download is a common video/audio/sub/... one; try to avoid the generic extractor; and/or use `--ignore-config --config-location ...` to not load config from common locations.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00325,"percentile":0.25525,"provenance":"source"},"cwes":[{"id":"CWE-669","name":"Incorrect Resource Transfer Between Spheres"}],"references":[{"url":"https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-79w7-vh3h-8g4j","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/yt-dlp/yt-dlp/commit/5ce582448ececb8d9c30c8c31f58330090ced03a","tags":["x_refsource_MISC"]},{"url":"https://github.com/yt-dlp/yt-dlp/releases/tag/2024.07.01","tags":["x_refsource_MISC"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-090_yt-dlp","tags":["x_refsource_MISC"]},{"url":"https://github.com/dirkf/youtube-dl/security/advisories/GHSA-22fp-mf44-f2mq","tags":["x_refsource_MISC"]},{"url":"https://securitylab.github.com/advisories/GHSL-2024-089_youtube-dl/","tags":["x_refsource_MISC"]},{"url":"https://github.com/ytdl-org/youtube-dl/pull/32830","tags":["x_refsource_MISC"]},{"url":"https://github.com/ytdl-org/youtube-dl/commit/d42a222ed541b96649396ef00e19552aef0f09ec","tags":["x_refsource_MISC"]}],"priority":{"score":10.6,"factors":[{"name":"EPSS percentile","points":5.1},{"name":"CVSS severity","points":5.46}]},"vendorSlug":"yt-dlp","affectedVersions":[{"vendor":"yt-dlp","product":"yt-dlp","versions":[">= < 2024.07.01, < 2024.07.01"]},{"vendor":"ytdl-org","product":"youtube-dl","versions":[">= >= 2015.01.25, <= 2021.12.17",">= nightly, < 2024-07-03"]}],"affected":[{"ecosystem":"PyPI","package":"yt-dlp","vulnerableRanges":["<2024.07.01"],"patched":["2024.07.01"],"from":["GHSA-79w7-vh3h-8g4j","PYSEC-2026-2065"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2285","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-yt-dlp-cve-2023-35934","parents":[{"from":"CVE-2024-22423","to":"CVE-2024-38519","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:yt-dlp","fromFixed":"2024.04.09","toFixed":"2024.07.01","daysApart":84},{"kind":"same-code","provenance":"machine","files":["devscripts/changelog_override.json","yt_dlp/YoutubeDL.py","yt_dlp/utils/_utils.py"],"commits":["https://github.com/yt-dlp/yt-dlp/commit/de015e930747165dbb8fcd360f8775fd973b7d6e","https://github.com/yt-dlp/yt-dlp/commit/ff07792676f404ffff6ee61b5638c9dc1a33a37a","https://github.com/yt-dlp/yt-dlp/commit/5ce582448ececb8d9c30c8c31f58330090ced03a"],"basis":"rarely changed file"}]},{"from":"CVE-2023-35934","to":"CVE-2024-38519","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["yt_dlp/YoutubeDL.py"],"commits":["https://github.com/yt-dlp/yt-dlp/commit/1ceb657bdd254ad961489e5060f2ccc7d556b729","https://github.com/yt-dlp/yt-dlp/commit/3121512228487c9c690d3d39bfd2579addf96e07","https://github.com/yt-dlp/yt-dlp/commit/5ce582448ececb8d9c30c8c31f58330090ced03a"],"basis":"rarely changed file"}]},{"from":"CVE-2023-40581","to":"CVE-2024-38519","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["devscripts/changelog_override.json","yt_dlp/utils/_utils.py"],"commits":["https://github.com/yt-dlp/yt-dlp/commit/de015e930747165dbb8fcd360f8775fd973b7d6e","https://github.com/yt-dlp/yt-dlp/commit/5ce582448ececb8d9c30c8c31f58330090ced03a"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2024-38519","to":"CVE-2026-50023","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519.","from":"CVE.org","in":"CVE-2026-50023"},{"kind":"osv-related","provenance":"source","id":"GHSA-c6mh-fpjc-4pr3","via":"reference","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38519"},{"kind":"osv-related","provenance":"source","id":"PYSEC-2026-3430","via":"reference","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38519"}]}],"packageHistory":[{"cve":"CVE-2023-40581","published":"2023-09-25","fixed":"2023.09.24","kev":false},{"cve":"CVE-2023-46121","published":"2023-11-14","fixed":"2023.11.14","kev":false},{"cve":"CVE-2024-22423","published":"2024-04-09","fixed":"2024.04.09","kev":false},{"cve":"CVE-2024-38519","published":"2024-07-02","fixed":"2024.07.01","kev":false},{"cve":"CVE-2026-26331","published":"2026-02-24","fixed":"2026.02.21","kev":false},{"cve":"CVE-2026-50019","published":"2026-06-23","fixed":"2026.6.9","kev":false},{"cve":"CVE-2026-50023","published":"2026-06-23","fixed":"2026.6.9","kev":false}],"package":"PyPI:yt-dlp"}}