8.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-50023

CVE-2026-50023: yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)

yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519. The allowlist explicitly included the unsafe extensions .desktop, .url, and .webloc so that the functionality of the --write-link option (and its variants) could be preserved. These allowlist inclusions can be exploited by an attacker to write malicious OS-shortcut files in the context of a media or subtitles download. This vulnerability is fixed in 2026.06.09.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-50023

CVE-2026-50023:

8.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
yt-dlp	pip	< 2026.06.09	2026.6.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a bypass of CVE-2024-38519 and stems from an incomplete fix that left dangerous OS-shortcut file extensions (.desktop, .url, .webloc) in a global allowlist. The core of the issue lies in yt_dlp/utils/_utils.py, specifically within the _UnsafeExtensionError.sanitize_extension method, which performed extension validation against this flawed list.

The exploit is triggered when yt-dlp processes remote, attacker-controlled content (e.g., an HLS manifest for subtitles via --write-subs) that specifies a malicious file extension. The application's file creation process calls utility functions like _change_extension, which in turn uses _UnsafeExtensionError.sanitize_extension for validation. Because the dangerous extensions were on the allowlist, the validation would pass, and a malicious file (e.g., MyVideo.en.desktop) would be written to the user's filesystem, leading to potential code execution through social engineering.

The patch rectifies this by removing the unsafe extensions from the global ALLOWED_EXTENSIONS set and introducing a mechanism to pass a context-specific list of allowed extensions (_allowed_exts) to the validation functions. This ensures that only the intended feature (--write-link) can create shortcut files, while all other file-writing operations correctly reject them.

Vulnerable functions

_UnsafeExtensionError.sanitize_extension

yt_dlp/utils/_utils.py

This class method was responsible for validating file extensions against a global allowlist. The vulnerability existed because this list (`ALLOWED_EXTENSIONS`) incorrectly included dangerous OS-shortcut extensions (`.desktop`, `.url`, `.webloc`). Any file-saving operation that determined an extension from untrusted input would use this function, which would permit the creation of a malicious file.

_change_extension

yt_dlp/utils/_utils.py

This function, used for setting file extensions, directly called the vulnerable `_UnsafeExtensionError.sanitize_extension` method. It passed untrusted extension strings to the sanitizer without any context-specific restrictions, making it a key component in the exploitation chain for writing malicious files.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.