GHSA-6v4j-43gg-vj32

Summary

If the --write-link, --write-url-link or --write-desktop-link options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the .url and .desktop shortcut files written by yt-dlp. This allows for malicious shell commands or malicious remote executables to run on the user's system if the user executes the generated .url or .desktop files.

Details

The expected result of yt-dlp's --write-link, --write-url-link and --write-desktop-link options is to write a shortcut file that points to the webpage URL for the content downloaded by yt-dlp. The --write-url-link option writes a .url shortcut file for Windows, the --write-desktop-link option writes a .desktop shortcut file for Linux, and the --write-link option may write a .url file or a .desktop file depending on the user's platform.

There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files.

Scenario 1: file:// URI injection in Windows .url shortcut

If a yt-dlp user passes the --write-link or --write-url-link option to generate a Windows .url file, the URL written to the shortcut file is sourced from the downloaded media's metadata--specifically, its webpage_url value. This value is commonly a normalized version of the input URL passed to yt-dlp by the user, but in some cases it may be extracted from untrusted web input. Validation of this webpage_url value is performed if it is fed back to yt-dlp as an input URL (e.g. via the --load-info-json option), but no validation is performed before it is output to a .url shortcut file.

This lack of validation is exploitable by a remote attacker who crafts a malicious metadata payload such...