Lucene search
+L

290 matches found

NVD
NVD
added 2025/07/22 10:15 p.m.15 views

CVE-2025-54072

yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder or , insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the...

8.1CVSS0.00557EPSS
SaveExploits0References3
OSV
OSV
added 2025/07/22 9:34 p.m.10 views

CVE-2025-54072 yt-dlp allows `--exec` command injection when using placeholder on Windows

yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder or , insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the...

7.5CVSS8.5AI score
SaveExploits0References5
Vulnrichment
Vulnrichment
added 2025/07/22 9:34 p.m.11 views

CVE-2025-54072 yt-dlp allows `--exec` command injection when using placeholder on Windows

yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder or , insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the...

7.5CVSS8.3AI score0.00557EPSS
SaveExploits0References3
Debian CVE
Debian CVE
added 2025/07/22 9:34 p.m.16 views

CVE-2025-54072

yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder or , insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the...

8.1CVSS6AI score0.00557EPSS
SaveExploits0
CVE
CVE
added 2025/07/22 9:34 p.m.53 views

CVE-2025-54072

The CVE-2025-54072 entry concerns yt-dlp prior to version 2025.07.21 on Windows, where using --exec with the default placeholder or {} led to insufficient sanitization of the expanded filepath and could cause remote code execution. This effectively bypasses the mitigation from CVE-2024-22423. Aff...

8.1CVSS8.1AI score0.00557EPSS
SaveExploits0References3Affected Software1
AlpineLinux
AlpineLinux
added 2025/07/22 9:34 p.m.27 views

CVE-2025-54072

yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder or , insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the...

8.1CVSS8.2AI score0.00557EPSS
SaveExploits0
Cvelist
Cvelist
added 2025/07/22 9:34 p.m.21 views

CVE-2025-54072 yt-dlp allows `--exec` command injection when using placeholder on Windows

yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder or , insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the...

7.5CVSS0.00557EPSS
SaveExploits0References3
CNNVD
CNNVD
added 2025/07/22 12:00 a.m.14 views

yt-dlp 操作系统命令注入漏洞

yt-dlp is the youtube-dl branch of yt-dlp based on the now inactive youtube-dlc. An operating system command injection vulnerability exists in yt-dlp version 2025.06.25 and earlier, which stems from insufficient path cleanup in the --exec option file, and could lead to remote code execution...

8.1CVSS8.1AI score0.00557EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2025/07/21 12:00 a.m.20 views

PT-2025-30264 · Eslint +1 · @Eslint/Plugin-Kit +1

Name of the Vulnerable Software and Affected Versions: yt-dlp versions 2025.06.25 and below Description: yt-dlp is a command-line audio/video downloader. A flaw exists where, on Windows, using the --exec option with the default placeholder or results in insufficient sanitization of the expanded...

8.3CVSS8.2AI score0.01254EPSS
SaveExploits1References12
Tenable Nessus
Tenable Nessus
added 2025/06/16 12:00 a.m.7 views

TencentOS Server 4: yt-dlp (TSSA-2024:1138)

"The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:1138 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

9.8CVSS7.7AI score0.01292EPSS
SaveExploits2References2
RedhatCVE
RedhatCVE
added 2025/05/23 6:40 a.m.11 views

CVE-2024-51933

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dozyde Cookie Nonsense for YT yt-cookie-nonsense allows DOM-Based XSS.This issue affects Cookie Nonsense for YT: from n/a through = 1.2.0...

6.5CVSS7.2AI score0.00241EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2025/05/22 11:13 p.m.10 views

CVE-2022-34065

The Rondolu-YT-Concate package in PyPI v0.1.0 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges...

9.8CVSS7.8AI score0.02079EPSS
SaveExploits1References1
Vulnrichment
Vulnrichment
added 2025/04/24 6:04 p.m.17 views

CVE-2025-43858 YoutubeDLSharp allows command injection on windows system due to non sanitized arguments

YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. In versions starting from 1.0.0-beta4 and prior to 1.1.2, an unsafe conversion of arguments allows the injection of a malicious commands when starting yt-dlp from a commands prompt running on Windows OS with...

9.2CVSS9.5AI score0.00264EPSS
SaveExploits0References3
OSV
OSV
added 2025/04/23 10:25 p.m.32 views

GHSA-2JH5-G5CH-43Q5 YoutubeDLSharp allows command injection on windows system due to non sanitized arguments

Summary This vulnerability only apply when running on a Windows OS. An unsafe conversion of arguments allows the injection of a malicous commands when starting yt-dlp from a commands prompt. !CAUTION NOTE THAT DEPENDING ON THE CONTEXT AND WHERE THE LIBRARY IS USED, THIS MAY HAVE MORE SEVERE...

9.2CVSS7.6AI score0.00264EPSS
SaveExploits0References5
Github Security Blog
Github Security Blog
added 2025/04/23 10:25 p.m.35 views

YoutubeDLSharp allows command injection on windows system due to non sanitized arguments

Summary This vulnerability only apply when running on a Windows OS. An unsafe conversion of arguments allows the injection of a malicous commands when starting yt-dlp from a commands prompt. !CAUTION NOTE THAT DEPENDING ON THE CONTEXT AND WHERE THE LIBRARY IS USED, THIS MAY HAVE MORE SEVERE...

9.2CVSS7.6AI score0.00264EPSS
SaveExploits0References5Affected Software1
Tenable Nessus
Tenable Nessus
added 2025/03/05 12:00 a.m.8 views

Linux Distros Unpatched Vulnerability : CVE-2024-38519

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to the fixed versions, yt-dlp and youtube-dl do not limit the extensions of downloaded...

7.8CVSS6AI score0.00325EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 2025/03/05 12:00 a.m.12 views

Linux Distros Unpatched Vulnerability : CVE-2023-46121

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a...

5CVSS5.1AI score0.00321EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 2025/03/05 12:00 a.m.10 views

Linux Distros Unpatched Vulnerability : CVE-2023-35934

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak...

8.2CVSS7.7AI score0.01047EPSS
SaveExploits0References3
CNNVD
CNNVD
added 2025/02/19 12:00 a.m.12 views

WordPress plugin YouTube Playlists with Schema 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...

6.4CVSS8.3AI score0.0033EPSS
SaveExploits0References2
SUSE CVE
SUSE CVE
added 2025/02/14 4:53 a.m.7 views

SUSE CVE-2024-38519

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to the fixed versions, yt-dlp and youtube-dl do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder and path traversal on Windows. Since yt-dlp and youtube-...

7.8CVSS6.9AI score0.00325EPSS
SaveExploits0References4
Rows per page
Query Builder