CVE-2026-50023: yt-dlp Arbitrary Shortcut File Write – Patch Now (v2026.06.09)

Technical summary

CVE-2026-50023 is an arbitrary file write vulnerability in yt-dlp prior to version 2026.06.09. The vulnerability exists because the remediation for CVE-2024-38519 included an allowlist that explicitly permitted unsafe OS-shortcut extensions (.desktop, .url, .webloc) to support the --write-link option and its variants. An attacker can exploit this by embedding malicious shortcut metadata in downloaded media files or subtitle streams, causing yt-dlp to write these malicious shortcut files to the user's filesystem. The attack vector is network-based and requires user interaction (downloading content), with a CVSS 3.1 score of 8.3 (HIGH) reflecting high impact across confidentiality, integrity, and availability.

Business impact

Organizations and individuals using yt-dlp to download video or audio content face potential code execution within the user's security context. Successful exploitation could lead to unauthorized access to files, data exfiltration, or malware deployment on workstations. This is particularly concerning in environments where yt-dlp is part of media processing pipelines or automation workflows, where a single compromised download could propagate malicious shortcuts across multiple systems. The attack is stealthy—users may not immediately recognize that shortcut files have been planted.

Affected systems

yt-dlp versions prior to 2026.06.09 are affected. All users of yt-dlp who download media files or enable subtitle fetching are at risk. The vulnerability does not require special configuration; the default behavior with media downloads activates the vulnerable code path. There is no indication of active exploitation in the wild at the time of publication, but the ease of exploitation (network-based, requires common usage) makes rapid patching advisable.

Exploitability

Exploitation requires network access and user interaction—specifically, the user must initiate a download of media or subtitles from an attacker-controlled or compromised source. An attacker cannot remotely trigger yt-dlp execution without user action. However, once triggered, the attack is highly reliable because it abuses the intentional allowlist without requiring bypass techniques. The conditional access (AC:H in CVSS) reflects the need for a specific user action and potentially indirect delivery (e.g., via social engineering to download from a malicious site), but does not significantly raise the barrier to exploitation for motivated attackers.

Remediation

Update yt-dlp to version 2026.06.09 or later. This patch removed the unsafe extensions from the allowlist or re-implemented the --write-link functionality in a way that does not expose the system to arbitrary shortcut file writes. No workaround exists for older versions short of disabling subtitle downloads or accepting the risk. Verify the update is installed by running `yt-dlp --version` and confirming it returns 2026.06.09 or a later date-based version.

Patch guidance

Patch immediately. Given the HIGH severity score and the ease of triggering the vulnerability through normal usage, prioritize yt-dlp updates across all affected systems. If yt-dlp is installed via package managers (pip, apt, brew, etc.), use the standard update command for your platform. Verify the patched version is running in production environments and in any automation or batch-download scripts. Ensure users are notified to update their local copies if yt-dlp is commonly used across your organization.

Detection guidance

Monitor for unexpected .desktop, .url, or .webloc files appearing in directories where yt-dlp downloads are stored (often the current working directory or user's home/Downloads folder). These files are particularly suspicious if they appear alongside downloaded media and were not created by the user. Review yt-dlp logs if verbose mode is enabled (`-v` flag) for any write operations to these file types. Consider blocking or quarantining these extensions at the filesystem or endpoint level in high-security environments. Endpoint detection tools should flag the creation of executable shortcuts in download directories as anomalous.

Why prioritize this

HIGH severity, network-accessible vulnerability with practical exploitability. The allowlist-based design makes exploitation trivial—no complex bypass is needed. The attack surface is large (any user downloading media), and the impact (code execution) is severe. Although not yet listed in CISA's KEV catalog, the combination of ease and impact makes this a priority patch candidate. Organizations should treat this as urgent, especially if yt-dlp is used in production workflows or by many users.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH) reflects: (1) network-based attack vector with no authentication required, (2) high impact across confidentiality (attacker can read files in user context), integrity (arbitrary files written), and availability (files can disrupt system functionality or trigger DoS via malicious shortcuts), (3) conditional access complexity due to user interaction requirement, (4) changed scope because the shortcut files can affect the broader system if executed. The score appropriately captures the severity while acknowledging that exploitation requires a user to download content, which is a common behavior for yt-dlp users.

Frequently asked questions