CVE-2026-50023

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-50023
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-50023.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-50023
Aliases
Downstream
Related
Published
2026-06-23T16:08:43.003Z
Modified
2026-07-13T16:57:44.493952077Z
Severity
  • 8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
Details

yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519. The allowlist explicitly included the unsafe extensions .desktop, .url, and .webloc so that the functionality of the --write-link option (and its variants) could be preserved. These allowlist inclusions can be exploited by an attacker to write malicious OS-shortcut files in the context of a media or subtitles download. This vulnerability is fixed in 2026.06.09.

Database specific 
{
    "cwe_ids": [
        "CWE-641"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50023.json"
}
References

Affected packages

Git / github.com/yt-dlp/yt-dlp

Affected ranges

Type
GIT
Repo
https://github.com/yt-dlp/yt-dlp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7f7bdc974dc61d941d1a0d51c4e21a0fdb7b2d06
Fixed
e578e265f7c6ca94a74b30e0d8d6196a4d19fb6a
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2026.06.09"
        }
    ],
    "cpe": "cpe:2.3:a:yt-dlp_project:yt-dlp:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}
Type
GIT
Repo
https://github.com/yt-dlp/yt-dlp-nightly-builds
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
496c0e4319db4359aebd8d3270b681c890cafa28
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2026.06.09"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

2021.*
2021.01.07
2021.01.08
2021.01.09
2021.01.10
2021.01.12
2021.01.14
2021.01.16
2021.01.20
2021.01.29
2021.02.04
2021.02.09
2021.02.15
2021.02.19
2021.02.24
2021.03.01
2021.03.03.2
2021.03.07
2021.03.15
2021.03.24
2021.03.24.1
2021.04.03
2021.04.11
2021.04.22
2021.05.11
2021.06.01
2021.06.08
2021.06.09
2021.06.23
2021.07.07
2021.07.21
2021.07.24
2021.08.02
2021.08.10
2021.09.02
2021.09.25
2021.10.09
2021.10.10
2021.10.22
2021.11.10
2021.11.10.1
2021.12.01
2021.12.25
2021.12.27
2022.*
2022.02.03
2022.02.04
2022.03.08.1
2022.04.08
2022.05.18
2022.06.22
2022.06.22.1
2022.06.29
2022.07.18
2022.08.08
2022.08.14
2022.08.19
2022.09.01
2022.10.04
2022.11.11
2023.*
2023.01.02
2023.01.06
2023.02.17
2023.03.03
2023.03.03.195451
2023.03.04
2023.03.04.070258
2023.03.04.133528
2023.06.21
2023.06.22
2023.07.06
2023.09.24
2023.10.07
2023.10.13
2023.11.14
2023.11.16
2023.12.30
2024.*
2024.03.10
2024.04.09
2024.05.26
2024.05.27
2024.07.01
2024.07.02
2024.07.07
2024.07.08
2024.07.09
2024.07.16
2024.07.25
2024.08.01
2024.08.06
2024.09.27
2024.10.07
2024.10.22
2024.11.04
2024.11.18
2024.12.03
2024.12.06
2024.12.13
2024.12.23
2025.*
2025.01.12
2025.01.15
2025.01.26
2025.02.19
2025.03.21
2025.03.25
2025.03.26
2025.03.27
2025.03.31
2025.04.30
2025.05.22
2025.06.09
2025.06.25
2025.06.30
2025.07.21
2025.08.11
2025.08.20
2025.08.22
2025.08.27
2025.09.05
2025.09.23
2025.09.26
2025.10.14
2025.10.22
2025.11.12
2025.12.08
2026.*
2026.01.29
2026.01.31
2026.02.04
2026.02.21
2026.03.03
2026.03.13
2026.03.17

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-50023.json"