Yt-Dlp · Yt-Dlp · CVE-2025-54072
**Name of the Vulnerable Software and Affected Versions**
yt-dlp versions 2025.06.25 and below
eslint/plugin-kit version 0.3.3 and earlier
**Description**
yt-dlp is a command-line audio/video downloader vulnerable to remote code execution on Windows systems when the `--exec` option is used with the default placeholder or {}. This is due to insufficient sanitization of the expanded filepath. A previous mitigation for CVE-2024-22423 did not cover the default placeholder and {} expansion.
Additionally, @eslint/plugin-kit is affected by a Regular Expression Denial of Service (ReDoS) vulnerability.
**Recommendations**
yt-dlp versions 2025.06.25 and below: Upgrade to version 2025.07.21 or later.
eslint/plugin-kit versions 0.3.3 and earlier: Upgrade to version 0.3.3 or later.