Vulnerability in yt-dlp Command-Line Downloader Exposes User Filesystem

CVE-2026-50023

What is CVE-2026-50023?

A vulnerability in the yt-dlp command-line audio/video downloader allows unauthorized remote access to write arbitrary OS-shortcut files (.desktop, .url, .webloc) to a user's filesystem. This issue stems from improper handling of extensions in the allowlist, specifically including potentially unsafe file types necessary for certain functionalities. Attackers can exploit this vulnerability during media or subtitle downloads, resulting in the creation of malicious shortcuts. Users are strongly advised to update their yt-dlp to version 2026.06.09 or later to mitigate this security risk.

References