CVE-2026-50023 Details
Description
yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519. The allowlist explicitly included the unsafe extensions .desktop, .url, and .webloc so that the functionality of the --write-link option (and its variants) could be preserved. These allowlist inclusions can be exploited by an attacker to write malicious OS-shortcut files in the context of a media or subtitles download. This vulnerability is fixed in 2026.06.09.
A vulnerability in yt-dlp, a command-line audio/video downloader, allows remote attackers to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem. This issue, present in versions prior to 2026.06.09, bypasses a previous remediation for CVE-2024-38519. The vulnerability arises from an allowlist that mistakenly included these unsafe extensions to preserve the functionality of the --write-link option. Exploitation can occur by crafting a malicious m3u8 file that, when downloaded with certain yt-dlp options, results in the creation of a shortcut file containing attacker-controlled content.
Users are advised to upgrade yt-dlp to version 2026.06.09 or later. Those unable to upgrade should only use trusted input URLs, avoid certain yt-dlp options that could trigger the vulnerability, and manually select download formats to validate file extensions.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/yt-dlp/yt-dlp/commit/e578e265f7c6ca94a74b30e0d8d6196a4d19fb6a | [email protected] | Patch |
| https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2026.06.09.230517 | [email protected] | ProductRelease Notes |
| https://github.com/yt-dlp/yt-dlp/releases/tag/2026.06.09 | [email protected] | ProductRelease Notes |
| https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-c6mh-fpjc-4pr3 | [email protected] | ExploitMitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-641 | Improper Restriction of Names for Files and Other Resources | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| yt-dlp project yt-dlp | < 2026.06.09 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |