Quick answers
- Is CVE-2026-50023 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-50023 being exploited in the wild.
- How severe is CVE-2026-50023?
- High severity, with a CVSS score of 8.3, published 23 June 2026.
- Which products and versions are affected?
- yt-dlp (PyPI) < 2026.06.09, ECOSYSTEM:introduced=0,fixed=2026.6.9.
- Is there a fix for CVE-2026-50023?
- Yes. yt-dlp (PyPI): upgrade to 2026.6.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-50023 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-50023?
- Check whether you run yt-dlp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- yt-dlp (PyPI): upgrade to 2026.6.9 or later
pip install "yt-dlp>=2026.6.9"
Technical details
A vulnerability in yt-dlp (CWE-641) allows for improper restriction of file names, enabling a remote attacker to write arbitrary OS-shortcut files (.desktop, .url, .webloc) to a user's filesystem. This issue stems from an overly permissive allowlist that included these extensions to maintain '--write-link' functionality, effectively bypassing previous fixes for CVE-2024-38519. An attacker can exploit this by providing malicious metadata in the context of a media or subtitles download. Successful exploitation requires user interaction to trigger the download and subsequently open the malicious shortcut. The vulnerability is addressed in version 2026.06.09 by restricting these extensions specifically to the '--write-link' feature.
Affected products
- yt-dlp yt-dlp < 2026.06.09
Identifiers
- CVE-2026-50023
- GHSA-c6mh-fpjc-4pr3
- PYSEC-2026-3430
Timeline
- 2026-06-09: patched: Fixed in version 2026.06.09
- 2026-06-23: advisory: NVD publication date