yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519. The allowlist explicitly included the unsafe extensions .desktop, .url, and .webloc so that the functionality of the --write-link option (and its variants) could be preserved. These allowlist inclusions can be exploited by an attacker to write malicious OS-shortcut files in the context of a media or subtitles download. This vulnerability is fixed in 2026.06.09.
2021.12.01-12021.12.27-12022.01.21-12022.02.04-12022.03.08.1-12022.04.08-12023.07.06-12023.10.13-1ubuntu12023.11.16-12023.12.30-1ubuntu12024.03.10-12024.04.09-12025.03.27-12025.04.30-12025.05.22-12025.06.09-12025.06.25-12025.06.30-12025.07.21-12025.08.11-12025.08.20-12025.08.22-1+3 more2025.09.23-12025.10.22-12025.11.12-12025.12.08-12026.01.31-12026.03.17-1Exploitability
AV:NAC:HPR:NUI:RScope
S:CImpact
C:HI:HA:HCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H