CVE-2026-50023: yt-dlp RCE Vulnerability

CVE-2026-50023 Overview

CVE-2026-50023 affects yt-dlp, a widely used command-line audio and video downloader. The vulnerability allows a remote attacker to write arbitrary operating system shortcut files such as .desktop, .url, and .webloc to the user's filesystem. It bypasses the remediation previously applied for CVE-2024-38519, which addressed unsafe extension writes. The original allowlist explicitly preserved these three extensions to keep the --write-link option and its variants functional. Attackers can abuse this allowlist during a media or subtitles download to drop malicious shortcut files. The issue is fixed in yt-dlp version 2026.06.09 [CWE-641].

Critical Impact
Remote attackers can write executable OS-shortcut files to the user's filesystem during a normal yt-dlp download, enabling code execution and persistence vectors when shortcuts are triggered.

Affected Products

yt-dlp versions prior to 2026.06.09
All platforms supporting .desktop shortcuts (Linux)
All platforms supporting .url (Windows) and .webloc (macOS) shortcuts

Discovery Timeline

2026-06-23 - CVE-2026-50023 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-50023

Vulnerability Analysis

The vulnerability stems from an overly permissive extension allowlist in yt-dlp's filename sanitization logic. When yt-dlp originally addressed CVE-2024-38519, the maintainers added _UnsafeExtensionError.sanitize_extension to block unsafe output extensions. To preserve the --write-link, --write-url-link, --write-webloc-link, and --write-desktop-link features, the allowlist explicitly included .desktop, .url, and .webloc. An attacker who controls metadata returned during a media or subtitles download can leverage this allowlist to direct yt-dlp into writing attacker-controlled shortcut content with one of these extensions. Shortcut files execute commands or open URLs when activated by the user, providing a code-execution and phishing primitive [CWE-641].

Root Cause

The root cause is improper restriction of names for files and other resources. The sanitize_extension routine accepted .desktop, .url, and .webloc as globally safe extensions rather than restricting them to the link-writing code path. Any download flow reaching the extension replacement logic could therefore produce a shortcut file.

Attack Vector

Exploitation requires user interaction: the victim must run yt-dlp against a malicious or attacker-influenced source. Successful exploitation depends on attacker-controlled metadata (such as ext or related fields) reaching the filename construction path. Once a shortcut file is written into a directory parsed by the operating system (for example, a Linux autostart directory or a user-visible folder), the payload can execute commands or redirect the user to attacker-controlled URLs.

python

# Security patch in yt_dlp/utils/_utils.py
# Restricts unsafe extensions to the link-writing code path via _allowed_exts
-def _change_extension(prepend, filename, ext, expected_real_ext=None):
+def _change_extension(prepend, filename, ext, expected_real_ext=None, *, _allowed_exts=()):
     name, real_ext = os.path.splitext(filename)

     if not expected_real_ext or real_ext[1:] == expected_real_ext:
         filename = name
         if prepend and real_ext:
-            _UnsafeExtensionError.sanitize_extension(ext, prepend=True)
+            _UnsafeExtensionError.sanitize_extension(ext, prepend=True, _allowed_exts=_allowed_exts)
             return f'{filename}.{ext}{real_ext}'

-    return f'{filename}.{_UnsafeExtensionError.sanitize_extension(ext)}'
+    return f'{filename}.{_UnsafeExtensionError.sanitize_extension(ext, _allowed_exts=_allowed_exts)}'

Source: yt-dlp commit e578e26

Detection Methods for CVE-2026-50023

Indicators of Compromise

Unexpected .desktop, .url, or .webloc files appearing in download directories or user autostart paths after yt-dlp runs.
Shortcut files containing Exec= (Linux .desktop) or URL= entries that reference shells, interpreters, or unfamiliar remote hosts.
yt-dlp process activity writing files with shortcut extensions outside of explicit --write-link invocations.

Detection Strategies

Hunt filesystem telemetry for shortcut file creations by Python interpreters or yt-dlp processes in user profile directories.
Inspect content of newly created .desktop files for Exec= lines pointing to /bin/sh, bash, curl, or wget commands.
Correlate yt-dlp invocations with downstream child-process executions originating from user shells or shortcut launchers.

Monitoring Recommendations

Audit endpoints running yt-dlp versions prior to 2026.06.09 and inventory deployed package versions.
Alert on creation of files with .desktop, .url, or .webloc extensions in directories such as ~/.config/autostart/, ~/Desktop/, and Windows Startup folders.
Monitor outbound network connections initiated shortly after shortcut file activation for signs of payload retrieval.

How to Mitigate CVE-2026-50023

Immediate Actions Required

Upgrade yt-dlp to version 2026.06.09 or later on all systems and CI pipelines.
Audit existing download directories for shortcut files written by previous yt-dlp runs and remove any unexpected entries.
Restrict yt-dlp execution to least-privileged user accounts and avoid running it against untrusted URLs.

Patch Information

The fix is included in the yt-dlp 2026.06.09 release via commit e578e26. The patch removes url, desktop, and webloc from the global safe-extension allowlist and scopes them to the link-writing code path through a new _allowed_exts parameter. Full details are available in the GHSA-c6mh-fpjc-4pr3 advisory.

Workarounds

Avoid using yt-dlp against untrusted or attacker-controlled URLs until the upgrade is applied.
Disable shortcut writing options such as --write-link, --write-url-link, --write-webloc-link, and --write-desktop-link in scripts and configuration files.
Run yt-dlp inside a sandboxed or containerized environment with a non-persistent download directory.

bash

# Upgrade yt-dlp to the patched release
python3 -m pip install --upgrade 'yt-dlp>=2026.06.09'

# Verify the installed version
yt-dlp --version

# Example: disable link-writing options in a yt-dlp configuration file
# ~/.config/yt-dlp/config
--no-write-link
--no-write-url-link
--no-write-webloc-link
--no-write-desktop-link