Yt-dlp Project vulnerabilities
We track 3 vulnerabilities in Yt-dlp Project products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on July 2, 2024.
Latest Yt-dlp Project vulnerabilities
- 7.8 High severity
yt-dlp: Incorrect Resource Transfer Between Spheres
`yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path t
- 9.8 Critical severity
Node.js: Improper Neutralization of Special Elements used in a Command
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
- 7.8 High severity
yt-dlp: Improper Neutralization of Special Elements used in an OS Command
yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the `--exec` flag. This flag allows output template expansion in its argument,