CVE-2024-38519: yt-dlp File system modification and RCE through improper file-extension sanitization

July 2, 2024

yt-dlp does not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows). Since yt-dlp also reads config from the working directory (and on Windows executables will be executed from the yt-dlp directory) this could lead to arbitrary code being executed.

References

github.com/advisories/GHSA-79w7-vh3h-8g4j
github.com/yt-dlp/yt-dlp
github.com/yt-dlp/yt-dlp/commit/5ce582448ececb8d9c30c8c31f58330090ced03a
github.com/yt-dlp/yt-dlp/releases/tag/2024.07.01
github.com/yt-dlp/yt-dlp/security/advisories/GHSA-79w7-vh3h-8g4j
nvd.nist.gov/vuln/detail/CVE-2024-38519

Code Behaviors & Features

Detect and mitigate CVE-2024-38519 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →