🚨 HIGH - Arbitrary OS shortcut file write via crafted media/subtitle extensions (CVE-2026-50023) yt-dlp is vulnerable to being tricked into writing attacker-chosen OS shortcut files (e.g., .desktop, .url, .webloc) to a user’s filesystem during downloads, affecting its filename/extension handling logic. The root cause is improper input validation/insufficient restrictions on output filename extensions, allowing a bypass of the earlier mitigation for CVE-2024-38519. An attacker exploits this by providing attacker-controlled media/subtitle extension sources (notably crafted m3u8 subtitle URIs) so that when the victim downloads content with yt-dlp, a malicious shortcut payload is written without needing elevated privileges. Impact includes planting phishing lures and persistence-like artifacts, with potential code execution or credential theft if the user later opens the generated shortcut file. 👉 Affected: yt-dlp < 2026.06.09 | Upgrade to 2026.06.09
Post summary
High severity vulnerability in yt-dlp allows arbitrary OS shortcut file writes via crafted media/subtitle URIs; users should upgrade to version 2026.06.09 to mitigate.