PatchSiren cyber security CVE debrief
CVE-2026-50023 yt-dlp CVE debrief
CVE-2026-50023 is a high-severity vulnerability in yt-dlp, a command-line audio/video downloader. Prior to version 2026.06.09, the vulnerability allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem. This is possible because the allowlist for the --write-link option included unsafe extensions like .desktop, .url, and .webloc. An attacker can exploit these allowlist inclusions to write malicious OS-shortcut files during media or subtitles downloads. The vulnerability is fixed in version 2026.06.09. Users should update to this version to mitigate the risk.
- Vendor
- yt-dlp
- Product
- Unknown
- CVSS
- HIGH 8.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-23
- Original CVE updated
- 2026-06-26
- Advisory published
- 2026-06-23
- Advisory updated
- 2026-06-26
Who should care
This vulnerability affects users of yt-dlp who use the --write-link option or its variants. System administrators and users who download media or subtitles using yt-dlp should be aware of this vulnerability and update to version 2026.06.09 or later to prevent potential exploitation.
Technical summary
CVE-2026-50023 is a vulnerability in yt-dlp that allows remote attackers to write arbitrary OS-shortcut files to the user's filesystem. The vulnerability exists because the allowlist for the --write-link option includes unsafe extensions like .desktop, .url, and .webloc. An attacker can exploit this by writing malicious OS-shortcut files during media or subtitles downloads. The vulnerability has a CVSS score of 8.3 and is classified as HIGH severity. It is fixed in yt-dlp version 2026.06.09.
Defensive priority
High priority should be given to updating yt-dlp to version 2026.06.09 or later. Users should also be cautious when downloading media or subtitles using yt-dlp and avoid using the --write-link option with untrusted sources.
Recommended defensive actions
- Update yt-dlp to version 2026.06.09 or later
- Avoid using the --write-link option with untrusted sources
- Be cautious when downloading media or subtitles using yt-dlp
- Monitor system logs for suspicious OS-shortcut file creations
- Implement additional security measures to detect and prevent exploitation
Evidence notes
The vulnerability is confirmed by the CVE record and NVD detail. The CVE record provides a description of the vulnerability and its impact. The NVD detail provides additional information on the vulnerability, including its CVSS score and severity.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-50023 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-50023
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-50023 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-50023
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2026.06.09.230517
[email protected] - Product, Release Notes
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://github.com/yt-dlp/yt-dlp/commit/e578e265f7c6ca94a74b30e0d8d6196a4d19fb6a
[email protected] - Patch
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://github.com/yt-dlp/yt-dlp/releases/tag/2026.06.09
[email protected] - Product, Release Notes
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-c6mh-fpjc-4pr3
[email protected] - Exploit, Mitigation, Patch, Vendor Advisory
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.