CVE-2026-50023

Name of the Vulnerable Software and Affected Versions yt-dlp versions prior to 2026.06.09

Description A flaw allows a remote attacker to write arbitrary OS-shortcut files, such as .desktop, .url, and .webloc, to the user's filesystem. This occurs because the file extension allowlist used to prevent unsafe downloads explicitly included these shortcut extensions to maintain the functionality of the --write-link option. Attackers can exploit this by crafting a malicious m3u8 file containing an EXT-X-MEDIA:TYPE=SUBTITLES tag with a malicious URI. If a user employs the --write-subs option, the software may write attacker-controlled content to a file with a shortcut extension. These files can contain shell commands or point to remote executables, enabling phishing attacks or arbitrary code execution if a user is deceived into opening them.

Recommendations Update yt-dlp to version 2026.06.09. As a temporary workaround, only provide fully trusted input URLs to the software. As a temporary workaround, avoid using the --write-subs, --write-auto-subs, --embed-subs, --write-thumbnail, --write-all-thumbnails, or --embed-thumbnail options. As a temporary workaround, use --format - to interactively select download formats and validate their file extensions.