1290 matches found
Remote Code Execution (RCE)
yt-dlp is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper handling of the --exec placeholder on Windows, allowing crafted file paths to execute arbitrary commands...
Command Injection
Overview yt-dlp is an A youtube-dl fork with additional features and patches Affected versions of this package are vulnerable to Command Injection via the function parsecmd in the class ExecPP, which the --exec process on Windows uses with the default placeholder. An attacker can execute arbitrar...
broken-source (0.9.0.dev1), daa-music (>=0.0.2, <=0.0.5) +36 more potentially affected by CVE-2025-54072 via yt-dlp (>=2025.1.12, <=2025.6.30)
yt-dlp PYPI version =2025.1.12, =0.0.2, =0.0.2.2, =0.1.0, =3.2.0, =0.0.1, =1.2.0, =0.2.0, =0.1.1a2, =0.1.2 - music-bot-py 1.0.1 and more Source cves: CVE-2025-54072 Source advisory: SNYK:PYTHON-YTDLP-10878169...
CVE-2025-54072
yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder or , insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the...
CVE-2025-54072 yt-dlp allows `--exec` command injection when using placeholder on Windows
yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder or , insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the...
CVE-2025-54072 yt-dlp allows `--exec` command injection when using placeholder on Windows
yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder or , insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the...
CVE-2025-54072
The CVE-2025-54072 entry concerns yt-dlp prior to version 2025.07.21 on Windows, where using --exec with the default placeholder or {} led to insufficient sanitization of the expanded filepath and could cause remote code execution. This effectively bypasses the mitigation from CVE-2024-22423. Aff...
CVE-2025-54072
yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder or , insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the...
CVE-2025-54072
yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder or , insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the...
CVE-2025-54072 yt-dlp allows `--exec` command injection when using placeholder on Windows
yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder or , insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the...
africanwhisper (>=0.2.8, <=0.9.0), aishell (>=2023.3.3, <=2023.4.11) +148 more potentially affected by CVE-2025-54072 via yt-dlp (>=2021.9.2, <=2025.6.30)
yt-dlp PYPI version =2021.9.2, =0.2.8, =2023.3.3, =0.1.0, =0.3.0, =0.1.0, =0.0.4, =0.9.0, =1.4.0, =2024.3.25, =1.1.1, =0.0.2, =0.0.5 - deezer-downloader 2.0.0 - depthflow 0.9.0.dev1 and more Source cves: CVE-2025-54072 Source advisory: MEND:CVE-2025-54072...
CVE-2025-54072
yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder or , insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the...
yt-dlp operating system command injection vulnerability
yt-dlp is the youtube-dl branch of yt-dlp based on the now inactive youtube-dlc. An operating system command injection vulnerability exists in yt-dlp version 2025.06.25 and earlier, which stems from insufficient path cleanup in the --exec option file, and could lead to remote code execution...
CVE-2025-54072: Improper Neutralization of Special Elements used in an OS Command
yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder or , insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the...
PT-2025-30264
Name of the Vulnerable Software and Affected Versions yt-dlp versions 2025.06.25 and below eslint/plugin-kit version 0.3.3 and earlier Description yt-dlp is a command-line audio/video downloader vulnerable to remote code execution on Windows systems when the --exec option is used with the default...
TencentOS Server 4: yt-dlp (TSSA-2024:1138)
"The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:1138 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
CVE-2024-9678
An SQL Injection vulnerability existed in DLP Extension 11.11.1.3. The vulnerability allowed an attacker to perform arbitrary SQL queries potentially leading to command execution...
CVE-2024-11616
Netskope was made aware of a security vulnerability in Netskope Endpoint DLP’s Content Control Driver where a double-fetch issue leads to heap overflow. The vulnerability arises from the fact that the NumberOfBytes argument to ExAllocatePoolWithTag, and the Length argument for RtlCopyMemory, both...