PT-2024-28047 · Yt-Dlp+2 · Yt-Dlp+2
Jarlob
+1
·
Published
2024-07-02
·
Updated
2026-06-16
·
CVE-2024-38519
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
yt-dlp versions prior to 2024.07.01
youtube-dl versions prior to 2024-07-03
Description
The issue concerns command-line audio/video downloaders
yt-dlp and youtube-dl. Prior to the fixed versions, these tools do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder and path traversal on Windows. Since yt-dlp and youtube-dl also read config from the working directory, this could lead to arbitrary code being executed. To mitigate this, users should have .%(ext)s at the end of the output template, trust the websites they download from, and avoid downloading to sensitive locations.Recommendations
For
yt-dlp versions prior to 2024.07.01, upgrade to version 2024.07.01 or later.
For youtube-dl versions prior to 2024-07-03, update to a nightly build tagged 2024-07-03 or later.
For users who cannot upgrade, keep the default output template, ensure the media extension is common, avoid the generic extractor, and use --ignore-config --config-location ... to not load config from common locations.Exploit
Fix
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Youtube-Dl
Yt-Dlp