CVE-2024-38519

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior
to the fixed versions, yt-dlp and youtube-dl do not limit the
extensions of downloaded files, which could lead to arbitrary filenames
being created in the download folder (and path traversal on Windows). Since
yt-dlp and youtube-dl also read config from the working directory (and
on Windows executables will be executed from the yt-dlp or youtube-dl
directory), this could lead to arbitrary code being executed.
yt-dlp version 2024.07.01 fixes this issue by whitelisting the allowed
extensions. youtube-dl fixes this issue in commit d42a222 on the
master branch and in nightly builds tagged 2024-07-03 or later. This
might mean some very uncommon extensions might not get downloaded, however
it will also limit the possible exploitation surface. In addition to
upgrading, have .%(ext)s at the end of the output template and make sure
the user trusts the websites that they are downloading from. Also, make
sure to never download to a directory within PATH or other sensitive
locations like one’s user directory, system32, or other binaries
locations. For users who are not able to upgrade, keep the default output
template (-o "%(title)s [%(id)s].%(ext)s); make sure the extension of the
media to download is a common video/audio/sub/… one; try to avoid the
generic extractor; and/or use --ignore-config --config-location ... to
not load config from common locations.