CVE-2024-22423 yt-dlp `--exec` command injection when using `%q` in yt-dlp on Windows
Attackers can execute arbitrary commands on Windows systems by exploiting insufficient escaping in the --exec option of yt-dlp.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-22423?
CVE-2024-22423 is a high-severity command injection vulnerability in yt-dlp, published on 9 Apr 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using `--exec` with `%q` by replacing double quotes with two double quotes. However, this escaping is not sufficient, and still allows expansion of environment variables. Support for output template expansion in `--exec`, along with this vulnerable behavior, was added to `yt-dlp` in version 2021.04.11. yt-dlp version 2024.04.09 fixes this issue by properly escaping `%`. It replaces them with `%%cd:~,%`, a variable that expands to nothing, leaving only the leading percent. It is recommended to upgrade yt-dlp to version 2024.04.09 as soon as possible. Also, always be careful when using `--exec`, because while this specific vulnerability has been patched, using unvalidated input in shell commands is inherently dangerous. For Windows users who are not able to upgrade, avoid using any output template expansion in `--exec` other than `{}` (filepath); if expansion in `--exec` is needed, verify the fields you are using do not contain `"`, `|` or `&`; and/or instead of using `--exec`, write the info json and load the fields from it instead.
Weakness: CWE-78
Which versions are affected by CVE-2024-22423?
3 open source packages ship an affected version, including yt-dlp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
yt-dlp PyPI | From 2021.04.11 | 2024.04.09 |
yt-dlp PyPI | From 2021.04.11 | 2024.04.09 |
yt-dlp PyPI | From 2021.04.11 | 2024.04.09 |
Linux distribution packages (1)
yt-dlp openSUSE:Tumbleweed | All versions | 2024.04.09-1.1 |
Products include Yt-Dlp Project Yt-Dlp.
How do I fix CVE-2024-22423?
Upgrade yt-dlp to 2024.04.09 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-22423 being exploited?
There is no known exploitation of CVE-2024-22423 in the wild and no public exploit code.
Other vulnerabilities in yt-dlp
- CVE-2026-26331 yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
- CVE-2023-40581 yt-dlp command injection when using `%q` in `--exec` on Windows
- CVE-2026-50023 yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
- CVE-2026-50574 yt-dlp: Arbitrary code execution via manifest downloads with aria2c
- CVE-2026-55404 yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
Sources
Also known as GHSA-hjq6-52gw-2g7p, PYSEC-2026-2066, UBUNTU-CVE-2024-22423, openSUSE-SU-2024:13854-1.