Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519. The allowlist explicitly included the unsafe extensions .desktop, .url, and .webloc so that the functionality of the --write-link option (and its variants) could be preserved. These allowlist inclusions can be exploited by an attacker to write malicious OS-shortcut files in the context of a media or subtitles download. This vulnerability is fixed in 2026.06.09.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-24 | 1 | Patch1 |
| 2026-10-06 | 2 | Disclosure2 |
How a shortcut-extension exception in yt-dlp's CVE-2024-38519 fix opened the door to CVE-2026-50023, and what the follow-up bug teaches us. #vulnerabilityresearch #cve202650023...Show more https://t.co/KdnvzOTt2X
Post summary
The tweet announces and discusses CVE-2026-50023 as a follow-up bug arising from a prior fix in yt-dlp, without mentioning patches, exploits, or active exploitation.
Read the full story👇 https://hackernoon.com/from-global-allowlist-to-rce-breaking-down-cve-2026-50023-in-yt-dlp
Post summary
The tweet serves as a brief announcement linking to a Hackernoon article about CVE-2026-50023 in yt-dlp, but contains no PoC, exploit code, active exploitation claims, patch information, or detailed technical specifications within the text itself.
🚨 HIGH - Arbitrary OS shortcut file write via crafted media/subtitle extensions (CVE-2026-50023) yt-dlp is vulnerable to being tricked into writing attacker-chosen OS shortcut files (e.g., .desktop, .url, .webloc) to a user’s filesystem during downloads, affecting its filename/extension handling logic. The root cause is improper input validation/insufficient restrictions on output filename extensions, allowing a bypass of the earlier mitigation for CVE-2024-38519. An attacker exploits this by providing attacker-controlled media/subtitle extension sources (notably crafted m3u8 subtitle URIs) so that when the victim downloads content with yt-dlp, a malicious shortcut payload is written without needing elevated privileges. Impact includes planting phishing lures and persistence-like artifacts, with potential code execution or credential theft if the user later opens the generated shortcut file. 👉 Affected: yt-dlp < 2026.06.09 | Upgrade to 2026.06.09
Post summary
High severity vulnerability in yt-dlp allows arbitrary OS shortcut file writes via crafted media/subtitle URIs; users should upgrade to version 2026.06.09 to mitigate.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | yt-dlp_project | yt-dlp | - | - | - |