CVE-2024-38519

Date: July 2, 2024

"yt-dlp" and "youtube-dl" are command-line audio/video downloaders. Prior to the fixed versions, "yt-dlp" and "youtube-dl" do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows). Since "yt-dlp" and "youtube-dl" also read config from the working directory (and on Windows executables will be executed from the "yt-dlp" or "youtube-dl" directory), this could lead to arbitrary code being executed. "yt-dlp" version 2024.07.01 fixes this issue by whitelisting the allowed extensions. "youtube-dl" fixes this issue in commit "d42a222" on the "master" branch and in nightly builds tagged 2024-07-03 or later. This might mean some very uncommon extensions might not get downloaded, however it will also limit the possible exploitation surface. In addition to upgrading, have ".%(ext)s" at the end of the output template and make sure the user trusts the websites that they are downloading from. Also, make sure to never download to a directory within PATH or other sensitive locations like one's user directory, "system32", or other binaries locations. For users who are not able to upgrade, keep the default output template ("-o "%(title)s [%(id)s].%(ext)s"); make sure the extension of the media to download is a common video/audio/sub/... one; try to avoid the generic extractor; and/or use "--ignore-config --config-location ..." to not load config from common locations.

Language: Python