The issue concerns command-line audio/video downloaders `yt-dlp` and `youtube-dl`. Prior to the fixed versions, these tools do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder and path traversal on Windows. Since `yt-dlp` and `youtube-dl` also read config from the working directory, this could lead to arbitrary code being executed. To mitigate this, users should have `.%(ext)s` at the end of the output template, trust the websites they download from, and avoid downloading to sensitive locations.