CVE-2024-38519

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to the fixed versions, yt-dlp and youtube-dl do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows). Since yt-dlp and youtube-dl also read config from the working directory (and on Windows executables will be executed from the yt-dlp or youtube-dl directory), this could lead to arbitrary code being executed.

yt-dlp version 2024.07.01 fixes this issue by whitelisting the allowed extensions. youtube-dl fixes this issue in commit d42a222 on the master branch and in nightly builds tagged 2024-07-03 or later. This might mean some very uncommon extensions might not get downloaded, however it will also limit the possible exploitation surface. In addition to upgrading, have .%(ext)s at the end of the output template and make sure the user trusts the websites that they are downloading from. Also, make sure to never download to a directory within PATH or other sensitive locations like one’s user directory, system32, or other binaries locations. For users who are not able to upgrade, keep the default output template (-o "%(title)s [%(id)s].%(ext)s); make sure the extension of the media to download is a common video/audio/sub/… one; try to avoid the generic extractor; and/or use --ignore-config --config-location ... to not load config from common locations.