CVE-2023-40581

Deeper analysis

yt-dlp, a youtube-dl fork used for downloading media from online sources, contains a command-injection flaw in its handling of the --exec flag on Windows. The flag supports output-template expansion so that metadata fields can be inserted into shell commands, with a %q conversion intended to quote values safely for subprocess execution under cmd. Because the escaping logic fails to neutralize characters such as ", |, and &, an attacker-supplied value can break out of the intended command and execute arbitrary code. The issue was introduced when template expansion for --exec was added in version 2021.04.11 and affects all subsequent releases until the fix in 2023.09.24; it is present regardless of whether yt-dlp is launched from cmd or PowerShell.

An attacker who controls metadata returned by a remote site (for example, a crafted video title or description) can trigger the vulnerability when a Windows user invokes --exec with that untrusted data. Successful exploitation yields remote code execution with the privileges of the yt-dlp process, satisfying the high impact metrics recorded in the CVSS 8.3 vector.

The project’s security advisory and release notes recommend immediate upgrade to version 2023.09.24, which applies correct escaping for every special character (substituting \r for \n). Users unable to upgrade are advised to restrict --exec expansions to the literal {} filepath placeholder, to whitelist only safe metadata fields, or to export the info JSON and process fields outside the shell.

EPSS scores have remained near 0.13 with no material post-disclosure climb, and no confirmed in-the-wild exploitation has been reported.