OS Command Injection Affecting yt-dlp package, versions [2021.4.11, 2023.9.24)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-YTDLP-5918285
- published 26 Sep 2023
- disclosed 25 Sep 2023
- credit Simon Sawicki
Introduced: 25 Sep 2023
CVE-2023-40581 Open this link in a new tabHow to fix?
Upgrade yt-dlp to version 2023.9.24 or higher.
Overview
yt-dlp is an A youtube-dl fork with additional features and patches
Affected versions of this package are vulnerable to OS Command Injection due to improper escaping of special characters in the cmd shell used by Python's subprocess, through the --exec flag.
Note:
This is only exploitable if yt-dlp is used on Windows, regardless of whether it's run from cmd or PowerShell. .
Workaround
For Windows users who are not able to upgrade:
Avoid using any output template expansion in --exec other than {} (filepath).
If expansion in --exec is needed, verify the fields you are using do not contain ", | or &.
Instead of using --exec, write the info json and load the fields from it instead.