CVE-2024-22423

Deeper analysis

yt-dlp is a command-line tool for downloading video content that introduced support for output template expansion inside the --exec option beginning with version 2021.04.11. A prior attempt to mitigate remote code execution (CVE-2023-40581) by doubling embedded double-quote characters proved insufficient, leaving an avenue for environment-variable expansion that results in OS command injection (CWE-78). The flaw affects all releases between 2021.04.11 and 2024.04.09 and carries a CVSS 3.1 score of 8.3.

An attacker who can influence the media URL, metadata, or output template supplied to yt-dlp can craft input that, when --exec is used, causes the victim’s shell to expand variables and execute arbitrary commands. Exploitation requires the user to invoke --exec with a template containing %q or similar placeholders and therefore depends on both network-supplied data and local command-line usage.

The project’s security advisory and accompanying patches state that version 2024.04.09 resolves the issue by replacing each percent sign with the inert sequence %%cd:~,% so that only a literal percent remains after expansion. Administrators are advised to upgrade immediately; Windows users unable to upgrade should restrict --exec templates to the literal {} placeholder, validate that no field contains ", | or &, or write the info JSON and consume fields from that file instead.

EPSS scores have remained low and essentially flat (current 0.0650, peak 0.0666), indicating no material post-disclosure surge in observed exploitation activity.