{"id":"CVE-2026-50023","published":"2026-06-23T16:08:43Z","modified":"2026-06-25T13:45:44Z","title":"yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)","vendor":"yt-dlp","product":"yt-dlp","tier":"tail","description":{"text":"yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519. The allowlist explicitly included the unsafe extensions .desktop, .url, and .webloc so that the functionality of the --write-link option (and its variants) could be preserved. These allowlist inclusions can be exploited by an attacker to write malicious OS-shortcut files in the context of a media or subtitles download. This vulnerability is fixed in 2026.06.09.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.3,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00665,"percentile":0.51757,"provenance":"source"},"cwes":[{"id":"CWE-641","name":"Improper Restriction of Names for Files and Other Resources"}],"references":[{"url":"https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-c6mh-fpjc-4pr3","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/yt-dlp/yt-dlp/commit/e578e265f7c6ca94a74b30e0d8d6196a4d19fb6a","tags":["x_refsource_MISC"]},{"url":"https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2026.06.09.230517","tags":["x_refsource_MISC"]},{"url":"https://github.com/yt-dlp/yt-dlp/releases/tag/2026.06.09","tags":["x_refsource_MISC"]}],"priority":{"score":16.2,"factors":[{"name":"EPSS percentile","points":10.35},{"name":"CVSS severity","points":5.81}]},"vendorSlug":"yt-dlp","affectedVersions":[{"vendor":"yt-dlp","product":"yt-dlp","versions":["< 2026.06.09"]}],"affected":[{"ecosystem":"PyPI","package":"yt-dlp","vulnerableRanges":["<2026.6.9"],"patched":["2026.6.9"],"from":["GHSA-c6mh-fpjc-4pr3","PYSEC-2026-3430"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-38493","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-yt-dlp-cve-2023-35934","parents":[{"from":"CVE-2024-38519","to":"CVE-2026-50023","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519.","from":"CVE.org","in":"CVE-2026-50023"},{"kind":"osv-related","provenance":"source","id":"GHSA-c6mh-fpjc-4pr3","via":"reference","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38519"},{"kind":"osv-related","provenance":"source","id":"PYSEC-2026-3430","via":"reference","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38519"}]}],"packageHistory":[{"cve":"CVE-2024-38519","published":"2024-07-02","fixed":"2024.07.01","kev":false},{"cve":"CVE-2026-26331","published":"2026-02-24","fixed":"2026.02.21","kev":false,"link":{"from":"CVE-2026-26331","to":"CVE-2026-50023","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:yt-dlp","fromFixed":"2026.02.21","toFixed":"2026.6.9","daysApart":119}]}},{"cve":"CVE-2026-50019","published":"2026-06-23","fixed":"2026.6.9","kev":false},{"cve":"CVE-2026-50023","published":"2026-06-23","fixed":"2026.6.9","kev":false},{"cve":"CVE-2026-50574","published":"2026-06-23","fixed":"2026.6.9","kev":false},{"cve":"CVE-2026-55404","published":"2026-07-08","fixed":"2026.7.4","kev":false}],"package":"PyPI:yt-dlp"}}