yt-dlp command injection when using `%q` in `--exec` on Windows

CVE-2023-40581

What is CVE-2023-40581?

The yt-dlp tool, a fork of youtube-dl, facilitates downloading from streaming services but contains a vulnerability on Windows platforms related to the --exec flag. This feature allows users to execute shell commands during downloads with metadata-based template expansions. However, improper escaping of special characters has been identified, making it possible for malicious users to inject code through crafted remote data. This issue exclusively affects versions of yt-dlp prior to 2023.09.24, where urgent updates have been provided to mitigate the risks associated with this vulnerability. Users are encouraged to upgrade immediately and exercise caution when employing the --exec option, especially when handling unverified input.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References