CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-38519 – yt-dlp and youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization
https://notcve.org/view.php?id=CVE-2024-38519
02 Jul 2024 — `yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows). Since `yt-dlp` and `youtube-dl` also read config from the working directory (and on Windows executables will be executed from the `yt-dlp` or `youtube-dl` directory), this could lead to arbitrary code being executed. `yt-dlp` vers... • https://github.com/dirkf/youtube-dl/security/advisories/GHSA-22fp-mf44-f2mq • CWE-669: Incorrect Resource Transfer Between Spheres •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46121 – Generic Extractor MITM Vulnerability in yt-dlp
https://notcve.org/view.php?id=CVE-2023-46121
14 Nov 2023 — yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP session. This could lead to cookie exfiltration in some cases. Version 2023.11.14 removed the ability to smuggle `http_headers` to the Generic extractor, as well as other extractors that use the same pattern. Users are advised to upgrade. • https://github.com/yt-dlp/yt-dlp/commit/f04b5bedad7b281bee9814686bba1762bae092eb • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 8.3EPSS: 0%CPEs: 2EXPL: 1CVE-2023-40581 – yt-dlp command injection when using `%q` in `--exec` on Windows
https://notcve.org/view.php?id=CVE-2023-40581
25 Sep 2023 — yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the `--exec` flag. This flag allows output template expansion in its argument, so that metadata values may be used in the shell commands. The metadata fields can be combined with the `%q` conversion, which is intended to quote/escape these values so they can be safely passed to the shell. However, the escaping used for `cmd` (the... • https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2023.09.24.003044 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-35934 – yt-dlp File Downloader cookie leak
https://notcve.org/view.php?id=CVE-2023-35934
06 Jul 2023 — yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external downloaders are affected, except for `curl` and `httpie` (version 3.1.0 or later). At the file... • https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2023.07.06.185519 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •