GHSA-22fp-mf44-f2mq youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization

Not scored Published 18 Apr 2025

Attackers can execute arbitrary code or modify files via malicious filenames due to improper extension sanitization in youtube-dl.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is GHSA-22fp-mf44-f2mq?

GHSA-22fp-mf44-f2mq is a path traversal vulnerability in youtube-dl, published on 18 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Description

This advisory follows the security advisory GHSA-79w7-vh3h-8g4j published by the yt-dlp/yt-dlp project to aid remediation of the issue in the ytdl-org/youtube-dl project.

Vulnerability

youtube-dl does not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows).

Impact

Since youtube-dl also reads config from the working directory (and, on Windows, executables will be executed from the youtube-dl directory by default) the vulnerability could allow the unwanted execution of local code, including downloads masquerading as, eg, subtitles.

Patches

The versions of youtube-dl listed as Patched remediate this vulnerability by disallowing path separators and whitelisting allowed extensions. As a result, some very uncommon extensions might not get downloaded.

Master code d42a222 or later and nightly builds tagged 2024-07-03 or later contain the remediation.

Workarounds

Any/all of the below considerations may limit exposure in case it is necessary to use a vulnerable version

have .%(ext)s at the end of the output template
download from websites that you trust
do not download to a directory within the executable search PATH or other sensitive locations, such as your user directory or system directories
in Windows versions that support it, set NoDefaultCurrentDirectoryInExePath to prevent the cmd shell's executable search adding the default directory before PATH
consider that the path traversal vulnerability as a result of resolving non_existent_dir\..\..\target does not exist in Linux or macOS
ensure the extension of the media to download is a common video/audio/… one (use --get-filename)
omit any of the subtitle options (--write-subs/ --write-srt, --write-auto-subs/--write-automatic-subs, --all-subs).

References

Which versions are affected by GHSA-22fp-mf44-f2mq?

2 open source packages ship an affected version, including youtube-dl.

Package	Affected	Fixed in
`youtube-dl` PyPI	From `2015.01.25` to `2021.12.17`	None
`youtube-dl` PyPI	From `2015.01.25` to `2021.12.17`	None

How do I fix GHSA-22fp-mf44-f2mq?

No fix has been published for GHSA-22fp-mf44-f2mq yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is GHSA-22fp-mf44-f2mq being exploited?

There is no known exploitation of GHSA-22fp-mf44-f2mq in the wild and no public exploit code.