CVE-2025-54072 yt-dlp allows `--exec` command injection when using placeholder on Windows

High 7.5 Published 22 Jul 2025 Updated 23 Jul 2025

Attackers can execute arbitrary commands on Windows systems using yt-dlp's --exec option with unsanitized placeholders, requiring user interaction.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-54072?

CVE-2025-54072 is a high-severity command injection vulnerability in yt-dlp, published on 22 Jul 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder (or {}), insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the mitigation for CVE-2024-22423 where the default placeholder and {} were not covered by the new escaping rules. Windows users who are unable to upgrade should avoid using --exec altogether. Instead, the --write-info-json or --dump-json options could be used, with an external script or command line consuming the JSON output. This is fixed in version 2025.07.21.

Weakness: CWE-78

Which versions are affected by CVE-2025-54072?

It affects 1 product.

Products include Yt-Dlp Project Yt-Dlp.

How do I fix CVE-2025-54072?

No fix has been published for CVE-2025-54072 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-54072 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-54072 exists.

Sources

Also known as GHSA-45hg-7f49-5h56.