Gamer191

**Nome do Software Vulnerável e Versões Afetadas** yt-dlp versões anteriores a 2026.07.04 **Description** A sanitização inadequada da saída ao usar a opção `--write-link` permite a injeção de comandos downstream. Isso ocorre porque os dados do arquivo de atalho não são devidamente validados e sanitizados antes de serem processados. **Recommendations** Atualize o yt-dlp para a versão 2026.07.04 ou posterior. Como medida paliativa temporária, evite usar a opção `--write-link` até que o software seja atualizado.

**Name of the Vulnerable Software and Affected Versions** yt-dlp versions 2025.06.25 and below eslint/plugin-kit version 0.3.3 and earlier **Description** yt-dlp is a command-line audio/video downloader vulnerable to remote code execution on Windows systems when the `--exec` option is used with the default placeholder or {}. This is due to insufficient sanitization of the expanded filepath. A previous mitigation for CVE-2024-22423 did not cover the default placeholder and {} expansion. Additionally, @eslint/plugin-kit is affected by a Regular Expression Denial of Service (ReDoS) vulnerability. **Recommendations** yt-dlp versions 2025.06.25 and below: Upgrade to version 2025.07.21 or later. eslint/plugin-kit versions 0.3.3 and earlier: Upgrade to version 0.3.3 or later.