CVE Explorer

CVE-2026-50023

yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519. The allowlist explicitly included the unsafe extensions .desktop, .url, and .webloc so that the functionality of the --write-link option (and its variants) could be preserved. These allowlist inclusions can be exploited by a

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:1de6bca19f35a5e88de61695f5686e4fbcf865620a0b159cec69ea537e805970

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"yt-dlp","vendor":"yt-dlp","versions":[{"status":"affected","version":"< 2026.06.09"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:2806bee6790576685321cdca22c013d6d7e94bdb53de71450f61b628b63907b5 · sha256:70415c5f752a6cbf… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:2806bee6790576685321cdca22c013d6d7e94bdb53de71450f61b628b63907b5 · sha256:70415c5f752a6cbf… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-641","description":"CWE-641: Improper Restriction of Names for Files and Other Resources","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:2806bee6790576685321cdca22c013d6d7e94bdb53de71450f61b628b63907b5 · sha256:70415c5f752a6cbf… · /containers/cna/problemTypes/0/descriptions/0

Source references

4 source assertions

{"name":"https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2026.06.09.230517","tags":["x_refsource_MISC"],"url":"https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2026.06.09.230517"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:2806bee6790576685321cdca22c013d6d7e94bdb53de71450f61b628b63907b5 · sha256:70415c5f752a6cbf… · /containers/cna/references/2

{"name":"https://github.com/yt-dlp/yt-dlp/commit/e578e265f7c6ca94a74b30e0d8d6196a4d19fb6a","tags":["x_refsource_MISC"],"url":"https://github.com/yt-dlp/yt-dlp/commit/e578e265f7c6ca94a74b30e0d8d6196a4d19fb6a"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:2806bee6790576685321cdca22c013d6d7e94bdb53de71450f61b628b63907b5 · sha256:70415c5f752a6cbf… · /containers/cna/references/1

{"name":"https://github.com/yt-dlp/yt-dlp/releases/tag/2026.06.09","tags":["x_refsource_MISC"],"url":"https://github.com/yt-dlp/yt-dlp/releases/tag/2026.06.09"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:2806bee6790576685321cdca22c013d6d7e94bdb53de71450f61b628b63907b5 · sha256:70415c5f752a6cbf… · /containers/cna/references/3

{"name":"https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-c6mh-fpjc-4pr3","tags":["x_refsource_CONFIRM"],"url":"https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-c6mh-fpjc-4pr3"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:2806bee6790576685321cdca22c013d6d7e94bdb53de71450f61b628b63907b5 · sha256:70415c5f752a6cbf… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer