CVE-2026-50023

CVE-2026-50023 affects yt-dlp prior to 2026.06.09. A vulnerability allows writing arbitrary OS-shortcut files (e.g., .desktop, .url, .webloc) to the user’s filesystem by exploiting an allowlist that was meant to preserve the --write-link functionality, bypassing CVE-2024-38519. The issue is trigg...