CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46121 – Generic Extractor MITM Vulnerability in yt-dlp
https://notcve.org/view.php?id=CVE-2023-46121
14 Nov 2023 — yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP session. This could lead to cookie exfiltration in some cases. Version 2023.11.14 removed the ability to smuggle `http_headers` to the Generic extractor, as well as other extractors that use the same pattern. Users are advised to upgrade. • https://github.com/yt-dlp/yt-dlp/commit/f04b5bedad7b281bee9814686bba1762bae092eb • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •
CVSS: 8.3EPSS: 0%CPEs: 2EXPL: 1CVE-2023-40581 – yt-dlp command injection when using `%q` in `--exec` on Windows
https://notcve.org/view.php?id=CVE-2023-40581
25 Sep 2023 — yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the `--exec` flag. This flag allows output template expansion in its argument, so that metadata values may be used in the shell commands. The metadata fields can be combined with the `%q` conversion, which is intended to quote/escape these values so they can be safely passed to the shell. However, the escaping used for `cmd` (the... • https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2023.09.24.003044 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-35934 – yt-dlp File Downloader cookie leak
https://notcve.org/view.php?id=CVE-2023-35934
06 Jul 2023 — yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external downloaders are affected, except for `curl` and `httpie` (version 3.1.0 or later). At the file... • https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2023.07.06.185519 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •