# CVE-2026-50023: yt-dlp arbitrary file write via OS-shortcut extensions

Source: https://junglewise.ai/threats/cve-2026-50023-yt-dlp-arbitrary-file-write-via-os-shortcut-extensions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-50023 · Severity: high · CVSS 8.3 · Published 2026-06-23

yt-dlp is a popular command-line tool used to download audio and video from various websites. A security flaw allows a remote attacker to trick the tool into creating malicious shortcut files on a user's computer during a download. If a user opens these files, it could lead to unauthorized actions or full system compromise.

Technologies: [yt-dlp (PyPI)](https://junglewise.ai/threats/technologies/yt-dlp). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-50023 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50023 being exploited in the wild.

**How severe is CVE-2026-50023?** High severity, with a CVSS score of 8.3, published 23 June 2026.

**Which products and versions are affected?** yt-dlp (PyPI) < 2026.06.09, ECOSYSTEM:introduced=0,fixed=2026.6.9.

**Is there a fix for CVE-2026-50023?** Yes. yt-dlp (PyPI): upgrade to 2026.6.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50023 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-50023?** Check whether you run yt-dlp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- yt-dlp (PyPI): upgrade to 2026.6.9 or later

  ```sh
  pip install "yt-dlp>=2026.6.9"
  ```


## Technical details

A vulnerability in yt-dlp (CWE-641) allows for improper restriction of file names, enabling a remote attacker to write arbitrary OS-shortcut files (.desktop, .url, .webloc) to a user's filesystem. This issue stems from an overly permissive allowlist that included these extensions to maintain '--write-link' functionality, effectively bypassing previous fixes for CVE-2024-38519. An attacker can exploit this by providing malicious metadata in the context of a media or subtitles download. Successful exploitation requires user interaction to trigger the download and subsequently open the malicious shortcut. The vulnerability is addressed in version 2026.06.09 by restricting these extensions specifically to the '--write-link' feature.

## Affected products

- yt-dlp yt-dlp < 2026.06.09

## Identifiers

- CVE-2026-50023
- GHSA-c6mh-fpjc-4pr3
- PYSEC-2026-3430

## Timeline

- 2026-06-09: patched: Fixed in version 2026.06.09
- 2026-06-23: advisory: NVD publication date

## References

- [https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2026.06.09.230517](https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2026.06.09.230517)
- [https://github.com/yt-dlp/yt-dlp/commit/e578e265f7c6ca94a74b30e0d8d6196a4d19fb6a](https://github.com/yt-dlp/yt-dlp/commit/e578e265f7c6ca94a74b30e0d8d6196a4d19fb6a)
- [https://github.com/yt-dlp/yt-dlp/releases/tag/2026.06.09](https://github.com/yt-dlp/yt-dlp/releases/tag/2026.06.09)
- [https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-c6mh-fpjc-4pr3](https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-c6mh-fpjc-4pr3)

## Related threats

- [PYSEC-2026-3432 - yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option](https://junglewise.ai/threats/cve-2026-26331-yt-dlp-arbitrary-command-injection-when-using-the-netrc-cmd)
- [yt-dlp and youtube-dl command injection in shortcut file generation](https://junglewise.ai/threats/cve-2026-55404-yt-dlp-and-youtube-dl-command-injection-in-shortcut-file)
- [PYSEC-2026-2065 - yt-dlp File system modification and RCE through improper file-extension sanitization](https://junglewise.ai/threats/cve-2024-38519-yt-dlp-file-system-modification-and-rce-through-improper-file)
- [PYSEC-2026-2066 - yt-dlp: `--exec` command injection when using `%q` in yt-dlp on Windows (Bypass of )](https://junglewise.ai/threats/cve-2024-22423-yt-dlp-exec-command-injection-when-using-q-in-yt-dlp-on-windows)
- [PYSEC-2026-2063 - yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection](https://junglewise.ai/threats/cve-2023-46121-yt-dlp-generic-extractor-mitm-via-arbitrary-proxy-injection)