Executive brief
yt-dlp on Windows vulnerable to `--exec` command injection when using `%q`
Affected products
- PyPI yt-dlp
Junglewise Threat Intelligence
CVE-2023-40581: PYSEC-2026-2064 - yt-dlp on Windows vulnerable to `--exec` command injection when using `%q`
CVE-2023-40581 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: yt-dlp (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-3432 - yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
- yt-dlp and youtube-dl command injection in shortcut file generation
- PYSEC-2026-2065 - yt-dlp File system modification and RCE through improper file-extension sanitization
- PYSEC-2026-2066 - yt-dlp: `--exec` command injection when using `%q` in yt-dlp on Windows (Bypass of )
- PYSEC-2026-2063 - yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection