CVE-2024-38519 yt-dlp and youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization
Attackers can execute arbitrary code or modify files via improper file-extension sanitization in yt-dlp and youtube-dl downloaders.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-38519?
CVE-2024-38519 is a high-severity path traversal vulnerability in yt-dlp youtube-dl, published on 2 Jul 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
`yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows). Since `yt-dlp` and `youtube-dl` also read config from the working directory (and on Windows executables will be executed from the `yt-dlp` or `youtube-dl` directory), this could lead to arbitrary code being executed.
`yt-dlp` version 2024.07.01 fixes this issue by whitelisting the allowed extensions. `youtube-dl` fixes this issue in commit `d42a222` on the `master` branch and in nightly builds tagged 2024-07-03 or later. This might mean some very uncommon extensions might not get downloaded, however it will also limit the possible exploitation surface. In addition to upgrading, have `.%(ext)s` at the end of the output template and make sure the user trusts the websites that they are downloading from. Also, make sure to never download to a directory within PATH or other sensitive locations like one's user directory, `system32`, or other binaries locations. For users who are not able to upgrade, keep the default output template (`-o "%(title)s [%(id)s].%(ext)s`); make sure the extension of the media to download is a common video/audio/sub/... one; try to avoid the generic extractor; and/or use `--ignore-config --config-location ...` to not load config from common locations.
Weakness: CWE-669
Which versions are affected by CVE-2024-38519?
3 open source packages ship an affected version, including yt-dlp.
| Package | Affected | Fixed in |
|---|---|---|
yt-dlp PyPI | All versions | 2024.07.01 |
yt-dlp PyPI | All versions | 2024.07.01 |
yt-dlp PyPI | All versions | 2024.07.01 |
Linux distribution packages (1)
yt-dlp openSUSE:Tumbleweed | All versions | 2024.07.01-1.1 |
How do I fix CVE-2024-38519?
Upgrade yt-dlp to 2024.07.01 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-38519 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-38519 exists.
Sources
Also known as DEBIAN-CVE-2024-38519, GHSA-79w7-vh3h-8g4j, PYSEC-2026-2065, UBUNTU-CVE-2024-38519, openSUSE-SU-2024:14094-1.