CVE-2026-50023
High · 8.3CVSS
8.3
EPSS
0.7%
Published
Jun 23, 2026
CISA due date
—
The record
yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519. The allowlist explicitly included the unsafe extensions .desktop, .url, and .webloc so that the functionality of the --write-link option (and its variants) could be preserved. These allowlist inclusions can be exploited by an attacker to write malicious OS-shortcut files in the context of a media or subtitles download. This vulnerability is fixed in 2026.06.09.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | yt-dlp | 0 | 2026.06.09-bp160.1.1 |
| openSUSE:Tumbleweed | yt-dlp | 0 | 2026.06.09-1.1 |
Related vulnerabilities
- CVE-2026-50574 yt-dlp is a command-line audio/video downloader. Also affects yt-dlp
- CVE-2026-50019 yt-dlp is a command-line audio/video downloader. Also affects yt-dlp
- CVE-2024-38519 `yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Also affects yt-dlp
- CVE-2019-25623 Luminance Studio 2.17 contains a denial of service vulnerability that allows local… CWE-641
- CVE-2026-25177 Improper restriction of names for files and other resources in Active Directory Domain… CWE-641