# GHSA-22fp-mf44-f2mq: youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization > Attackers can execute arbitrary code or modify files via malicious filenames due to improper extension sanitization in youtube-dl. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** A user has to click or open something - **Fix available:** No - **Published:** 18 Apr 2025 ## What is GHSA-22fp-mf44-f2mq? GHSA-22fp-mf44-f2mq is a path traversal vulnerability in youtube-dl, published on 18 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link. ### Official description #### Description This advisory follows the security advisory [GHSA-79w7-vh3h-8g4j published by the _yt-dlp/yt-dlp_ project](https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-79w7-vh3h-8g4j) to aid remediation of the issue in the _ytdl-org/youtube-dl_ project. ### Vulnerability _youtube-dl_ does not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows). ### Impact Since _youtube-dl_ also reads config from the working directory (and, on Windows, executables will be executed from the _youtube-dl_ directory by default) the vulnerability could allow the unwanted execution of local code, including downloads masquerading as, eg, subtitles. ### Patches The versions of _youtube-dl_ listed as _Patched_ remediate this vulnerability by disallowing path separators and whitelisting allowed extensions. As a result, some very uncommon extensions might not get downloaded. **Master code d42a222 or later and nightly builds tagged 2024-07-03 or later** contain the remediation. ### Workarounds Any/all of the below considerations may limit exposure in case it is necessary to use a vulnerable version * have `.%(ext)s` at the end of the output template * download from websites that you trust * do not download to a directory within the executable search `PATH` or other sensitive locations, such as your user directory or system directories * in Windows versions that support it, set [`NoDefaultCurrentDirectoryInExePath`](https://stackoverflow.com/a/50118548) to prevent the _cmd_ shell's executable search adding the default directory before `PATH` * consider that the path traversal vulnerability as a result of resolving `non_existent_dir\..\..\target` does not exist in Linux or macOS * ensure the extension of the media to download is a common video/audio/... one (use `--get-filename`) * omit any of the subtitle options (`--write-subs`/` --write-srt`, `--write-auto-subs`/`--write-automatic-subs`, `--all-subs`). ### References * [GHSA-79w7-vh3h-8g4j](https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-79w7-vh3h-8g4j) * https://github.com/ytdl-org/youtube-dl/pull/32830 ## Which versions are affected by GHSA-22fp-mf44-f2mq? 2 open source packages ship an affected version, including youtube-dl. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `youtube-dl` | PyPI | From 2015.01.25 to 2021.12.17 | None | | `youtube-dl` | PyPI | From 2015.01.25 to 2021.12.17 | None | ## How do I fix GHSA-22fp-mf44-f2mq? No fix has been published for GHSA-22fp-mf44-f2mq yet. Limit exposure of the affected software until one is available. ## Is GHSA-22fp-mf44-f2mq being exploited? There is no known exploitation of GHSA-22fp-mf44-f2mq in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for GHSA-22fp-mf44-f2mq and fix it if it is affected. What it is: GHSA-22fp-mf44-f2mq is a path traversal vulnerability in youtube-dl, published on 18 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link. Exploitation: There is no known exploitation of GHSA-22fp-mf44-f2mq in the wild and no public exploit code. Affected packages and fixed versions: - youtube-dl (PyPI): affected from 2015.01.25 up to 2021.12.17; no fix listed - youtube-dl (PyPI): affected from 2015.01.25 up to 2021.12.17; no fix listed Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/GHSA-22fp-mf44-f2mq/ (Markdown: https://insights.sbomify.com/GHSA-22fp-mf44-f2mq/index.md) ``` ## Sources - OSV: https://osv.dev/vulnerability/GHSA-22fp-mf44-f2mq --- From sbomify Insights: https://insights.sbomify.com/GHSA-22fp-mf44-f2mq/ Summaries are generated and may contain mistakes; the official description above is the record.