{"id":"CVE-2025-54072","aliases":["ALPINE-CVE-2025-54072","EUVD-2025-22381","GHSA-45hg-7f49-5h56"],"status":"published","title":"yt-dlp allows `--exec` command injection when using placeholder on Windows","description":"yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder (or {}), insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the mitigation for CVE-2024-22423 where the default placeholder and {} were not covered by the new escaping rules. Windows users who are unable to upgrade should avoid using --exec altogether. Instead, the --write-info-json or --dump-json options could be used, with an external script or command line consuming the JSON output. This is fixed in version 2025.07.21.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0065,"percentile":0.51634,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2025-07-22T21:34:43Z","modified":"2026-11-03T06:32:52Z","fixes":[{"ecosystem":"Alpine:v3.22","package":"yt-dlp","fixed_in":["0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"yt-dlp","fixed_in":["0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"yt-dlp","fixed_in":["0-r0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.22","package":"yt-dlp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"yt-dlp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"yt-dlp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0-r0"}]}]}],"products":[{"vendor":"yt-dlp","product":"yt-dlp"},{"vendor":"yt-dlp_project","product":"yt-dlp"}],"references":[{"url":"https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-45hg-7f49-5h56","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory"]},{"url":"https://github.com/yt-dlp/yt-dlp/commit/959ac99e98c3215437e573c22d64be42d361e863","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/yt-dlp/yt-dlp/releases/tag/2025.07.21","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-54072","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54072.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54072","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-54072","title":"yt-dlp allows `--exec` command injection when using placeholder on Windows","description":"yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder (or {}), insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the mitigation for CVE-2024-22423 where the default placeholder and {} were not covered by the new escaping rules. Windows users who are unable to upgrade should avoid using --exec altogether. Instead, the --write-info-json or --dump-json options could be used, with an external script or command line consuming the JSON output. This is fixed in version 2025.07.21.","status":"published","published":"2025-07-22T21:34:43.408Z","modified":"2025-07-23T18:30:06.761Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:32:27.28543Z"}],"euvd":[{"id":"EUVD-2025-22381","description":"yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder (or {}), insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the mitigation for CVE-2024-22423 where the default placeholder and {} were not covered by the new escaping rules. Windows users who are unable to upgrade should avoid using --exec altogether. Instead, the --write-info-json or --dump-json options could be used, with an external script or command line consuming the JSON output. This is fixed in version 2025.07.21.","status":"published","published":"2025-07-22T21:34:43Z","modified":"2025-07-23T18:30:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:04.806066Z"}],"nvd":[{"id":"CVE-2025-54072","description":"yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder (or {}), insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the mitigation for CVE-2024-22423 where the default placeholder and {} were not covered by the new escaping rules. Windows users who are unable to upgrade should avoid using --exec altogether. Instead, the --write-info-json or --dump-json options could be used, with an external script or command line consuming the JSON output. This is fixed in version 2025.07.21.","status":"published","published":"2025-07-22T22:15:37.943Z","modified":"2026-06-17T09:39:22.147Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:11:19.382856Z"}],"osv":[{"id":"ALPINE-CVE-2025-54072","description":"yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder (or {}), insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the mitigation for CVE-2024-22423 where the default placeholder and {} were not covered by the new escaping rules. Windows users who are unable to upgrade should avoid using --exec altogether. Instead, the --write-info-json or --dump-json options could be used, with an external script or command line consuming the JSON output. This is fixed in version 2025.07.21.","status":"published","published":"2025-07-22T22:15:37.943Z","modified":"2026-11-03T06:32:52.01953859Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"CVE-2025-54072","title":"yt-dlp allows `--exec` command injection when using placeholder on Windows","description":"yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder (or {}), insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the mitigation for CVE-2024-22423 where the default placeholder and {} were not covered by the new escaping rules. Windows users who are unable to upgrade should avoid using --exec altogether. Instead, the --write-info-json or --dump-json options could be used, with an external script or command line consuming the JSON output. This is fixed in version 2025.07.21.","status":"published","published":"2025-07-22T21:34:43.408Z","modified":"2026-10-28T02:30:37.491179982Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:44:50.863921Z"}]}}