Incorrect Resource Transfer Between Spheres Affecting youtube_dl package, versions [2015.01.25,]
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-YOUTUBEDL-10116724
- published14 May 2025
- disclosed18 Apr 2025
- creditJaroslav Lobačevski, pukkandan
Introduced: 18 Apr 2025
CVE NOT AVAILABLE CWE-669 (opens in a new tab)How to fix?
A fix was pushed into the master branch but not yet published.
Overview
youtube_dl is a YouTube video downloader
Affected versions of this package are vulnerable to Incorrect Resource Transfer Between Spheres via improper file extension sanitization, which could create arbitrary filenames in the download folder (and path traversal on Windows). An attacker can modify the file system and execute arbitrary code by crafting malicious filenames that bypass security checks.
Workaround
This vulnerability can be mitigated by ensuring the output template ends with
.%(ext)sDownloading only from trusted websites.
Avoiding downloads to directories within the executable search
PATHor other sensitive locations.Setting
NoDefaultCurrentDirectoryInExePathon Windows.Ensuring downloaded media has a common extension (use
--get-filename).Omitting subtitle download options (
--write-subs/--write-srt,--write-auto-subs/--write-automatic-subs,--all-subs).