CVE-2023-40581

CVE-2023-40581 concerns yt-dlp on Windows, where the --exec flag can perform shell commands with output template expansion. The underlying issue is that the escaping for cmd.exe is insufficient, allowing remote code execution when supplied data contains crafted metadata. The vulnerability is tied...

CVE-2023-40581 yt-dlp command injection when using `%q` in `--exec` on Windows

yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the --exec flag. This flag allows output template expansion in its argument, so that metadata values may be used in...

CVE-2023-40581 yt-dlp command injection when using `%q` in `--exec` on Windows

yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the --exec flag. This flag allows output template expansion in its argument, so that metadata values may be used in...

yt-dlp on Windows vulnerable to `--exec` command injection when using `%q`

Impact yt-dlp allows the user to provide shell commands to be executed at various stages in its download process through the --exec flag. This flag allows output template expansion in its argument, so that video metadata values may be used in the shell commands. The metadata fields can be combine...

basketcase (>=0.0.4, <=4.0.0), deezer-downloader (2.0.0) +32 more potentially affected by CVE-2023-40581 +1 more via yt-dlp (>=2021.9.2, <=2023.7.6)

yt-dlp PYPI version =2021.9.2, =0.0.4, =0.1.3, =11.7.1, =0.3.0, =0.4.0, =0.1.2, =0.1.0, =0.1.0, =0.4.0, =0.7.0b4, =0.0.1, =0.14.0, =1.3.7.dev0, =1.3.9.dev0 and more Source cves: CVE-2023-40581, CVE-2024-22423 Source advisory: OSV:GHSA-42H4-V29R-42QG...

basketcase (>=0.0.4, <=4.0.0), deezer-downloader (2.0.0) +32 more potentially affected by CVE-2023-40581 via yt-dlp (>=2021.9.2, <=2023.7.6)

yt-dlp PYPI version =2021.9.2, =0.0.4, =0.1.3, =11.7.1, =0.3.0, =0.4.0, =0.1.2, =0.1.0, =0.1.0, =0.4.0, =0.7.0b4, =0.0.1, =0.14.0, =1.3.7.dev0, =1.3.9.dev0 and more Source cves: CVE-2023-40581 Source advisory: GHSA-42H4-V29R-42QG...

GHSA-42H4-V29R-42QG yt-dlp on Windows vulnerable to `--exec` command injection when using `%q`

Impact yt-dlp allows the user to provide shell commands to be executed at various stages in its download process through the --exec flag. This flag allows output template expansion in its argument, so that video metadata values may be used in the shell commands. The metadata fields can be combine...

yt-dlp OS Command Injection Vulnerability

yt-dlp is based on the youtube-dl branch of the now inactive youtube-dlc. yt-dlp suffers from an operating system command injection vulnerability that stems from not properly escaping special characters...

CVE-2023-40581

yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the --exec flag. This flag allows output template expansion in its argument, so that metadata values may be used in...

PT-2023-9233

Name of the Vulnerable Software and Affected Versions yt-dlp versions 2021.04.11 through 2024.04.08 process versions prior to 1.6.19.0 Description The issue exists due to insufficient escaping of special characters, allowing for remote code execution when using the --exec flag with output templat...

CVE-2023-40581: Improper Neutralization of Special Elements used in an OS Command

yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the --exec flag. This flag allows output template expansion in its argument, so that metadata values may be used in...

PT-2023-5663

Name of the Vulnerable Software and Affected Versions yt-dlp versions 2021.04.11 through 2023.09.23 Description The issue arises from the improper escaping of special characters in shell commands executed through the --exec flag, allowing for remote code execution if used with maliciously crafted...

Live Webinar: Overcoming Generative AI Data Leakage Risks

As the adoption of generative AI tools, like ChatGPT, continues to surge, so does the risk of data exposure. According to Gartner's "Emerging Tech: Top 4 Security Risks of GenAI" report, privacy and data security is one of the four major emerging risks within generative AI. A new webinar featurin...

CVE-2023-4814

A Privilege escalation vulnerability exists in Trellix Windows DLP endpoint for windows which can be abused to delete any file/folder for which the user does not have permission to...

Privilege escalation

A Privilege escalation vulnerability exists in Trellix Windows DLP endpoint for windows which can be abused to delete any file/folder for which the user does not have permission to...

CVE-2023-4814

CVE-2023-4814 affects Trellix Data Loss Prevention Endpoint (DLPe) for Windows, specifically version 11.10.100.17 as cited by Nessus/CNNVD entries. The issue is a local privilege escalation vulnerability in Trellix Windows DLP Endpoint that can be abused to delete any file or folder for which the...

CVE-2023-4814

A Privilege escalation vulnerability exists in Trellix Windows DLP endpoint for windows which can be abused to delete any file/folder for which the user does not have permission to...

CVE-2023-4814

A Privilege escalation vulnerability exists in Trellix Windows DLP endpoint for windows which can be abused to delete any file/folder for which the user does not have permission to...

CVE-2023-4814: Execution with Unnecessary Privileges

A Privilege escalation vulnerability exists in Trellix Windows DLP endpoint for windows which can be abused to delete any file/folder for which the user does not have permission to...

PT-2023-30711

Name of the Vulnerable Software and Affected Versions Trellix Windows DLP endpoint for windows affected versions not specified Description A Privilege escalation issue exists in the Trellix Windows DLP endpoint for windows, allowing it to be abused to delete any file or folder for which the user...