{"answers":{"affected":"2 open source packages ship an affected version, including youtube-dl.","exploited":"There is no known exploitation of GHSA-22fp-mf44-f2mq in the wild and no public exploit code.","fix":"No fix has been published for GHSA-22fp-mf44-f2mq yet. Limit exposure of the affected software until one is available.","what":"GHSA-22fp-mf44-f2mq is a path traversal vulnerability in youtube-dl, published on 18 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-22fp-mf44-f2mq and fix it if it is affected.\n\nWhat it is: GHSA-22fp-mf44-f2mq is a path traversal vulnerability in youtube-dl, published on 18 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-22fp-mf44-f2mq in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- youtube-dl (PyPI): affected from 2015.01.25 up to 2021.12.17; no fix listed\n- youtube-dl (PyPI): affected from 2015.01.25 up to 2021.12.17; no fix listed\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-22fp-mf44-f2mq/ (Markdown: https://insights.sbomify.com/GHSA-22fp-mf44-f2mq/index.md)","id":"GHSA-22fp-mf44-f2mq","markdown":"https://insights.sbomify.com/GHSA-22fp-mf44-f2mq/index.md","name":"GHSA-22fp-mf44-f2mq","record":{"aliases":[],"analysis":{"component_type":"developer_tool","fix_type":"upgrade","impacts":["code_execution","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"YouTube downloader tool","requires_auth":"none","summary":"Attackers can execute arbitrary code or modify files via malicious filenames due to improper extension sanitization in youtube-dl.","user_interaction":"required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"#### Description\nThis advisory follows the security advisory [GHSA-79w7-vh3h-8g4j published by the _yt-dlp/yt-dlp_ project](https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-79w7-vh3h-8g4j) to aid remediation of the issue in the _ytdl-org/youtube-dl_ project.\n\n### Vulnerability\n_youtube-dl_ does not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows). \n\n### Impact\nSince _youtube-dl_ also reads config from the working directory (and, on Windows, executables will be executed from the _youtube-dl_ directory by default) the vulnerability could allow the unwanted execution of local code, including downloads masquerading as, eg, subtitles.\n\n### Patches\nThe versions of _youtube-dl_ listed as _Patched_ remediate this vulnerability by disallowing path separators and whitelisting allowed extensions. As a result, some very uncommon extensions might not get downloaded.\n\n**Master code d42a222 or later and nightly builds tagged 2024-07-03 or later** contain the remediation.\n\n### Workarounds\nAny/all of the below considerations may limit exposure in case it is necessary to use a vulnerable version\n* have `.%(ext)s` at the end of the output template\n* download from websites that you trust\n* do not download to a directory within the executable search `PATH` or other sensitive locations, such as your user directory or system directories\n* in Windows versions that support it, set [`NoDefaultCurrentDirectoryInExePath`](https://stackoverflow.com/a/50118548) to prevent the _cmd_ shell's executable search adding the default directory before `PATH`\n* consider that the path traversal vulnerability as a result of resolving `non_existent_dir\\..\\..\\target` does not exist in Linux or macOS\n* ensure the extension of the media to download is a common video/audio/... one (use `--get-filename`)\n* omit any of the subtitle options (`--write-subs`/` --write-srt`, `--write-auto-subs`/`--write-automatic-subs`, `--all-subs`).\n\n### References\n* [GHSA-79w7-vh3h-8g4j](https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-79w7-vh3h-8g4j)\n* https://github.com/ytdl-org/youtube-dl/pull/32830","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization","id":"GHSA-22fp-mf44-f2mq","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"path_traversal","year":"2025"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":[],"introduced":["2015.01.25"],"last_affected":["2021.12.17"],"package":"youtube-dl","purl":null,"source":"GHSA-22fp-mf44-f2mq"},{"ecosystem":"PyPI","fixed":[],"introduced":["2015.01.25"],"last_affected":["2021.12.17"],"package":"youtube-dl","purl":"pkg:pypi/youtube-dl","source":"GHSA-22fp-mf44-f2mq"}],"products":null,"published":"2025-04-18","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can execute arbitrary code or modify files via malicious filenames due to improper extension sanitization in youtube-dl.","url":"https://insights.sbomify.com/GHSA-22fp-mf44-f2mq/"}