CVE Intelligence
Analysis AI-assisted

CVE-2026-50023: yt-dlp: arbitrary OS-shortcut file write via allowlist bypass

A vulnerability in yt-dlp before 2026.06.09 lets a remote attacker write OS-shortcut files such as .desktop, .url and .webloc to the user's filesystem. It bypasses the earlier fix for CVE-2024-38519 because the allowlist explicitly permitted these extensions. Upgrading to 2026.06.09 or later is the documented remediation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A vulnerability in yt-dlp, a command-line audio and video downloader, allows a remote party to write arbitrary operating system shortcut files such as .desktop, .url and .webloc to the user's filesystem. The record describes this as a bypass of the earlier remediation for CVE-2024-38519. The issue is fixed in version 2026.06.09, as described in the GitHub advisory.

Impact

  • The allowlist explicitly included the extensions .desktop, .url and .webloc, so shortcut files of these types could be created during media or subtitle downloads.
  • NVD rates the issue 9.6 (critical) under CVSS 3.1, with high confidentiality, integrity and availability impact, changed scope and user interaction required. The CNA GitHub score is 8.3.
  • The practical consequences depend on how the operating system and user applications handle these file types (inference).

Affected products and versions

  • Yt-dlp Project Yt-dlp, versions before 2026.06.09.
  • The fix is included in 2026.06.09 according to the release notes.

Exploitation status

  • CISA KEV does not list this CVE in the record consulted.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Upgrade yt-dlp to version 2026.06.09 or later.
  • Until the update is applied, avoid downloading media or subtitles from untrusted sources and avoid using the link-writing option.
  • Run yt-dlp under a standard user account and keep download directories separate from locations where shortcut files may be auto-processed.

Detection guidance

  • Monitor download directories and desktop locations for unexpected new .desktop, .url or .webloc files.
  • Inventory yt-dlp installations across endpoints and package managers to identify versions below 2026.06.09.

Limitations of the available information

  • The record does not describe the exact conditions under which a shortcut file is written or executed, nor the platforms most affected.
  • The record does not identify the operating systems or applications that would process these file types.
  • The CWE identifier CWE-641 is listed without a name in the record.

Frequently asked questions

Which yt-dlp versions are affected by CVE-2026-50023?

The record lists versions before 2026.06.09 as affected. Upgrading to 2026.06.09 or later is the fix identified in the sources.

Is this vulnerability being actively exploited?

The CVE is not listed in CISA KEV in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.