Every CVESearch/Get API key

GHSA-22fp-mf44-f2mq

youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization

7.8 High

Description

This advisory follows the security advisory GHSA-79w7-vh3h-8g4j published by the yt-dlp/yt-dlp project to aid remediation of the issue in the ytdl-org/youtube-dl project.

Vulnerability

youtube-dl does not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows).

Impact

Since youtube-dl also reads config from the working directory (and, on Windows, executables will be executed from the youtube-dl directory by default) the vulnerability could allow the unwanted execution of local code, including downloads masquerading as, eg, subtitles.

Patches

The versions of youtube-dl listed as Patched remediate this vulnerability by disallowing path separators and whitelisting allowed extensions. As a result, some very uncommon extensions might not get downloaded.

Master code d42a222 or later and nightly builds tagged 2024-07-03 or later contain the remediation.

Workarounds

Any/all of the below considerations may limit exposure in case it is necessary to use a vulnerable version

  • have .%(ext)s at the end of the output template
  • download from websites that you trust
  • do not download to a directory within the executable search PATH or other sensitive locations, such as your user directory or system directories
  • in Windows versions that support it, set NoDefaultCurrentDirectoryInExePath to prevent the cmd shell's executable search adding the default directory before PATH
  • consider that the path traversal vulnerability as a result of resolving non_existent_dir\..\..\target does not exist in Linux or macOS
  • ensure the extension of the media to download is a common video/audio/... one (use --get-filename)
  • omit any of the subtitle options (--write-subs/ --write-srt, --write-auto-subs/--write-automatic-subs, --all-subs).

References

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

What each source reports

GitHub Advisories Score used7.8

youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization

Description

This advisory follows the security advisory GHSA-79w7-vh3h-8g4j published by the yt-dlp/yt-dlp project to aid remediation of the issue in the ytdl-org/youtube-dl project.

Vulnerability

youtube-dl does not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows).

Impact

Since youtube-dl also reads config from the working directory (and, on Windows, executables will be executed from the youtube-dl directory by default) the vulnerability could allow the unwanted execution of local code, including downloads masquerading as, eg, subtitles.

Patches

The versions of youtube-dl listed as Patched remediate this vulnerability by disallowing path separators and whitelisting allowed extensions. As a result, some very uncommon extensions might not get downloaded.

Master code d42a222 or later and nightly builds tagged 2024-07-03 or later contain the remediation.

Workarounds

Any/all of the below considerations may limit exposure in case it is necessary to use a vulnerable version

  • have .%(ext)s at the end of the output template
  • download from websites that you trust
  • do not download to a directory within the executable search PATH or other sensitive locations, such as your user directory or system directories
  • in Windows versions that support it, set NoDefaultCurrentDirectoryInExePath to prevent the cmd shell's executable search adding the default directory before PATH
  • consider that the path traversal vulnerability as a result of resolving non_existent_dir\..\..\target does not exist in Linux or macOS
  • ensure the extension of the media to download is a common video/audio/... one (use --get-filename)
  • omit any of the subtitle options (--write-subs/ --write-srt, --write-auto-subs/--write-automatic-subs, --all-subs).

References

Record
GHSA-22fp-mf44-f2mq
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-434, CWE-669
Updated
2026-11-02
OSV7.8

youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization

Description

This advisory follows the security advisory GHSA-79w7-vh3h-8g4j published by the yt-dlp/yt-dlp project to aid remediation of the issue in the ytdl-org/youtube-dl project.

Vulnerability

youtube-dl does not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows).

Impact

Since youtube-dl also reads config from the working directory (and, on Windows, executables will be executed from the youtube-dl directory by default) the vulnerability could allow the unwanted execution of local code, including downloads masquerading as, eg, subtitles.

Patches

The versions of youtube-dl listed as Patched remediate this vulnerability by disallowing path separators and whitelisting allowed extensions. As a result, some very uncommon extensions might not get downloaded.

Master code d42a222 or later and nightly builds tagged 2024-07-03 or later contain the remediation.

Workarounds

Any/all of the below considerations may limit exposure in case it is necessary to use a vulnerable version

  • have .%(ext)s at the end of the output template
  • download from websites that you trust
  • do not download to a directory within the executable search PATH or other sensitive locations, such as your user directory or system directories
  • in Windows versions that support it, set NoDefaultCurrentDirectoryInExePath to prevent the cmd shell's executable search adding the default directory before PATH
  • consider that the path traversal vulnerability as a result of resolving non_existent_dir\..\..\target does not exist in Linux or macOS
  • ensure the extension of the media to download is a common video/audio/... one (use --get-filename)
  • omit any of the subtitle options (--write-subs/ --write-srt, --write-auto-subs/--write-automatic-subs, --all-subs).

References

Record
GHSA-22fp-mf44-f2mq
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-434, CWE-669
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
youtube-dl
PyPI
2015.01.25 to 2021.12.17None known
youtube-dl
PyPI
2015.01.25 to 2021.12.17, plus listed versions
2015.01.30.12015.01.30.22015.02.022015.02.02.22015.02.02.4
Show 45 moreShow less
2015.02.02.52015.02.032015.02.03.12015.02.042015.02.062015.02.092015.02.09.12015.02.09.22015.02.09.32015.02.102015.02.10.12015.02.10.22015.02.10.32015.02.10.42015.02.10.52015.02.112015.02.162015.02.16.12015.02.172015.02.17.22015.02.182015.02.18.12015.02.192015.02.19.12015.02.19.22015.02.19.32015.02.202015.02.212015.02.232015.02.23.12015.02.242015.02.24.12015.02.24.22015.02.262015.02.26.12015.02.26.22015.02.282015.03.032015.03.03.12015.03.092015.03.152015.03.182015.03.242015.03.282015.04.03
None known

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-22fp-mf44-f2mq is a high vulnerability (CVSS 7.8) in youtube-dl, published April 18, 2025. No source lists public exploit code. No source names a fixed version.

References

This page doesn't list everything

Left out here: 430 versions. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open