{"uuid": "9f39ed98-dd38-40a6-b32a-65d5dfa0e104", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-69qj-pvh9-c5wg", "type": "seen", "source": "https://gist.github.com/alon710/67012fd2d01a0b46570236682933fc3c", "content": "# GHSA-69QJ-PVH9-C5WG: GHSA-69QJ-PVH9-C5WG: Command Injection in yt-dlp `--exec` Option\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-06-16\n> **Full Report:** https://cvereports.com/reports/GHSA-69QJ-PVH9-C5WG\n\n## Summary\nAn OS command injection vulnerability in yt-dlp before 2026.06.09 allows unauthenticated remote attackers to execute arbitrary shell commands via crafted media metadata when a user processes media using the --exec post-processing parameter with unsafe string interpolation conversions.\n\n## TL;DR\nUnsafe metadata interpolation in yt-dlp's post-processor allows remote command execution when downloading maliciously crafted media links with custom command execution templates.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-78\n- **Attack Vector**: Network\n- **CVSS v3.1**: 7.5 (High)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n- **Patched Version**: 2026.06.09\n\n## Affected Systems\n\n- yt-dlp command-line downloader utility\n- **yt-dlp**: >= 2021.04.11, < 2026.06.09 (Fixed in: `2026.06.09`)\n\n## Mitigation\n\n- Upgrade to yt-dlp version 2026.06.09 or newer.\n- Replace unsafe string interpolation formats like %()s with %()q inside executive templates.\n- Avoid running user-supplied command execution parameters with unvetted input links.\n\n**Remediation Steps:**\n1. Run 'pip install --upgrade yt-dlp' to pull the patched code.\n2. Search configuration files and terminal history for usages of '--exec'.\n3. Audit execution parameters and rewrite template conversion identifiers to use shell-quoted variants.\n4. Verify that '--compat-options allow-unsafe-exec-expansion' is not enabled.\n\n## References\n\n- [GitHub Security Advisory GHSA-69qj-pvh9-c5wg](https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-69qj-pvh9-c5wg)\n- [yt-dlp Pull Request #16883](https://github.com/yt-dlp/yt-dlp/pull/16883)\n- [Fix Commit 5faffa9](https://github.com/yt-dlp/yt-dlp/commit/5faffa999fd33b373d47773e8ee639d072accec2)\n- [yt-dlp Version 2026.06.09 Release Notes](https://github.com/yt-dlp/yt-dlp/releases/tag/2026.06.09)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-69QJ-PVH9-C5WG) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-16T23:01:53.000000Z"}