yt-dlp vulnerabilities
3 known vulnerabilities in yt-dlp from Yt-dlp Project. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.8 High severity
yt-dlp: Incorrect Resource Transfer Between Spheres
`yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path t
- 9.8 Critical severity
Node.js: Improper Neutralization of Special Elements used in a Command
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
- 7.8 High severity
yt-dlp: Improper Neutralization of Special Elements used in an OS Command
yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the `--exec` flag. This flag allows output template expansion in its argument,