PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-50023 yt-dlp CVE debrief

CVE-2026-50023 is a high-severity vulnerability in yt-dlp, a command-line audio/video downloader. Prior to version 2026.06.09, the vulnerability allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem. This is possible because the allowlist for the --write-link option included unsafe extensions like .desktop, .url, and .webloc. An attacker can exploit these allowlist inclusions to write malicious OS-shortcut files during media or subtitles downloads. The vulnerability is fixed in version 2026.06.09. Users should update to this version to mitigate the risk.

Vendor
yt-dlp
Product
Unknown
CVSS
HIGH 8.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-23
Original CVE updated
2026-06-26
Advisory published
2026-06-23
Advisory updated
2026-06-26

Who should care

This vulnerability affects users of yt-dlp who use the --write-link option or its variants. System administrators and users who download media or subtitles using yt-dlp should be aware of this vulnerability and update to version 2026.06.09 or later to prevent potential exploitation.

Technical summary

CVE-2026-50023 is a vulnerability in yt-dlp that allows remote attackers to write arbitrary OS-shortcut files to the user's filesystem. The vulnerability exists because the allowlist for the --write-link option includes unsafe extensions like .desktop, .url, and .webloc. An attacker can exploit this by writing malicious OS-shortcut files during media or subtitles downloads. The vulnerability has a CVSS score of 8.3 and is classified as HIGH severity. It is fixed in yt-dlp version 2026.06.09.

Defensive priority

High priority should be given to updating yt-dlp to version 2026.06.09 or later. Users should also be cautious when downloading media or subtitles using yt-dlp and avoid using the --write-link option with untrusted sources.

Recommended defensive actions

  • Update yt-dlp to version 2026.06.09 or later
  • Avoid using the --write-link option with untrusted sources
  • Be cautious when downloading media or subtitles using yt-dlp
  • Monitor system logs for suspicious OS-shortcut file creations
  • Implement additional security measures to detect and prevent exploitation

Evidence notes

The vulnerability is confirmed by the CVE record and NVD detail. The CVE record provides a description of the vulnerability and its impact. The NVD detail provides additional information on the vulnerability, including its CVSS score and severity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-50023 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-50023

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-50023 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-50023

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.