Executive brief
yt-dlp is a popular command-line tool used to download videos from various websites. A security flaw in its post-processing feature allows a malicious video to execute unauthorized commands on a user's computer if the user has configured the tool to run specific commands after a download. This could lead to a full system compromise or data theft if a user downloads a video with specially crafted titles or descriptions.
Technical details
A command injection vulnerability exists in yt-dlp's '--exec' post-processor. The component uses an 'output template syntax' that allows video metadata (like titles) to be interpolated into shell commands. While a safe conversion flag (%()q) exists to escape shell characters, other flags like %()s do not perform sanitization. An attacker can host a video with a title containing shell metacharacters (e.g., ';', '&', '|') which, when processed by a victim using a vulnerable --exec template, results in arbitrary OS command execution. This requires the victim to use the --exec flag with an unsafe template string. The issue is fixed in version 2026.06.09 by restricting allowed conversions to a safe whitelist.
Affected products
- yt-dlp yt-dlp >= 2021.4.11, < 2026.6.9
Timeline
- 2026-06-09: patched: Fixed in version 2026.06.09
- 2026-06-16: advisory: GitHub Advisory GHSA-69qj-pvh9-c5wg published
References
- https://api.github.com/users/independent-arg
- https://github.com/independent-arg
- https://api.github.com/users/independent-arg/gists%7B/gist_id%7D
- https://api.github.com/users/independent-arg/repos
- https://avatars.githubusercontent.com/u/251550460?v=4
- https://api.github.com/users/independent-arg/events%7B/privacy%7D