CVE-2026-50023

yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519. The allowlist explicitly included the unsafe extensions .desktop, .url, and .webloc so that the functionality of the --write-link option (and its variants) could be preserved. These allowlist inclusions can be exploited by an attacker to write malicious OS-shortcut files in the context of a media or subtitles download. This vulnerability is fixed in 2026.06.09.

• CWE-641

• https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2026.06.09.230517Product, Release Notes
• https://github.com/yt-dlp/yt-dlp/commit/e578e265f7c6ca94a74b30e0d8d6196a4d19fb6aPatch
• https://github.com/yt-dlp/yt-dlp/releases/tag/2026.06.09Product, Release Notes
• https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-c6mh-fpjc-4pr3Exploit, Mitigation, Patch, Vendor Advisory

Published

Jun 23, 2026

Last Modified

Jun 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50016pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm…8.8
• CVE-2026-50017pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm…6.5
• CVE-2026-50019yt-dlp is a command-line audio/video downloader. From 2023.0…7.4
• CVE-2026-5002A vulnerability has been found in PromtEngineer localGPT up …7.3
• CVE-2026-50020Netty is a network application framework for development of …5.3
• CVE-2026-50021pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm…8.1
• CVE-2026-50026Frappe is a full-stack web application framework. Prior to v…6.9
• CVE-2026-5003A vulnerability was found in PromtEngineer localGPT up to 4d…5.5
• CVE-2026-50030DataEase is an open source data visualization and analysis t…7.1
• CVE-2026-50031ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer ov…7.5
• CVE-2026-50032A NULL pointer dereference in the MMS Write Named Variable L…8.7
• CVE-2026-50033Local privilege escalation due to DLL hijacking vulnerabilit…7.3