OS Command Injection Affecting yt-dlp package, versions [2021.4.11, 2024.4.9)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-YTDLP-6594004
- published 10 Apr 2024
- disclosed 9 Apr 2024
- credit RyotaK, Simon Sawicki
Introduced: 9 Apr 2024
CVE-2024-22423 Open this link in a new tabHow to fix?
Upgrade yt-dlp to version 2024.4.9 or higher.
Overview
yt-dlp is an A youtube-dl fork with additional features and patches
Affected versions of this package are vulnerable to OS Command Injection due to insufficient escaping of double quotes in the --exec command's handling of %q, leading to the expansion of environment variables. An attacker can execute arbitrary code by crafting specific input that exploits the environment variable expansion feature.
Workaround
For Windows users who are not able to upgrade:
Avoid using any output template expansion in
--execother than{}(filepath).If expansion in
--execis needed, verify the fields you are using do not contain%,",|or&.Instead of using
--exec, write the info json and load the fields from it instead.