CVE-2024-38519

Published

02 July 2024

Modified

15 April 2026

CVSS Score v3.1 7.8

Click a component to see what it means

Raw vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0032 25th percentile

Risk Priority 56 floored blend · peak EPSS

Summary

CVE-2024-38519 is a high-severity Incorrect Resource Transfer Between Spheres (CWE-669) vulnerability in Github (inferred from references). Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Escape to Host (T1611); ranked at the 25th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SC-4 (Information in Shared System Resources) — see the control section below for these in your framework.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-2285

Vulnerability Data

`yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows).…

Since `yt-dlp` and `youtube-dl` also read config from the working directory (and on Windows executables will be executed from the `yt-dlp` or `youtube-dl` directory), this could lead to arbitrary code being executed. `yt-dlp` version 2024.07.01 fixes this issue by whitelisting the allowed extensions. `youtube-dl` fixes this issue in commit `d42a222` on the `master` branch and in nightly builds tagged 2024-07-03 or later. This might mean some very uncommon extensions might not get downloaded, however it will also limit the possible exploitation surface. In addition to upgrading, have `.%(ext)s` at the end of the output template and make sure the user trusts the websites that they are downloading from. Also, make sure to never download to a directory within PATH or other sensitive locations like one's user directory, `system32`, or other binaries locations. For users who are not able to upgrade, keep the default output template (`-o "%(title)s [%(id)s].%(ext)s`); make sure the extension of the media to download is a common video/audio/sub/... one; try to avoid the generic extractor; and/or use `--ignore-config --config-location ...` to not load config from common locations.

CWE(s): CWE-669

Related Threats

MITRE ATT&CK Enterprise Techniques

T1611 Escape to Host Privilege Escalation

Adversaries may break out of a container or virtualized environment to gain access to the underlying host.

attack.mitre.org →

Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-34158Shared CWE-669

CVE-2025-62775Shared CWE-669

CVE-2026-35542Shared CWE-669

CVE-2026-44917Shared CWE-669

CVE-2023-44100Shared CWE-669

CVE-2024-37891Shared CWE-669

CVE-2024-29018Shared CWE-669

CVE-2025-59692Shared CWE-669

CVE-2025-54310Shared CWE-669

CVE-2025-41660Shared CWE-669

Affected Assets

Github

—

inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent

Stop it (NIST 800-53)

—

Detect

Catch it (NIST detect / respond)

—

Harden

Shrink the surface (DISA STIG)

2 hardening rules · 2 OS baselines

Validate

Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

AC-4 Information Flow Enforcement good match

Enforces approved information flow authorizations between system components and connected systems, directly stopping improper resource transfers across spheres.

SC-4 Information in Shared System Resources good match

Prevents unintended information leakage through shared system resources when crossing sphere boundaries.

SC-7 Boundary Protection good match

Monitors and controls communications at external and key internal boundaries to block unauthorized transfers between trust domains.

AC-3 Access Enforcement partial match

Enforces logical access authorizations that limit resource transfers to only approved sphere crossings.

SC-2 Separation of System and User Functionality partial match

Separates user functionality from system management functions to avoid improper resource or behavior transfer between privilege spheres.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match

prevents

Least-privilege authorization policies directly constrain resource transfers across security domains.

PR.DS-02 partial match

prevents

Protecting data-in-transit can limit exposure during inter-sphere transfers but does not address control-flow or authorization errors.

PR.IR-01 partial match

prevents

Logical segmentation and access controls reduce unintended cross-sphere resource movement.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.31 Separation of development, test and production environments mostly match

prevents

Environment separation limits unintended resource leakage between spheres.

A.5.14 Information transfer partial match

degrades

Information-transfer rules can prevent improper resource hand-off between spheres.

A.5.15 Access control partial match

degrades

Access-control policies limit unintended control over transferred resources.

A.5.18 Access rights partial match

degrades

Managing access rights reduces risk of unauthorized resource transfer.