GHSA-22fp-mf44-f2mq
HIGHyoutube-dl vulnerable to file system modification and RCE through improper file-extension sanitization
Blast Radius
youtube-dlReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Description
This advisory follows the security advisory GHSA-79w7-vh3h-8g4j published by the yt-dlp/yt-dlp project to aid remediation of the issue in the ytdl-org/youtube-dl project.
Vulnerability
youtube-dl does not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows).
Impact
Since youtube-dl also reads config from the working directory (and, on Windows, executables will be executed from the youtube-dl directory by default) the vulnerability could allow the unwanted execution of local code, including downloads masquerading as, eg, subtitles.
Patches
The versions of youtube-dl listed as Patched remediate this vulnerability by disallowing path separators and whitelisting allowed extensions. As a result, some very uncommon extensions might not get downloaded.
Master code d42a222 or later and nightly builds tagged 2024-07-03 or later contain the remediation.
Workarounds
Any/all of the below considerations may limit exposure in case it is necessary to use a vulnerable version
- have
.%(ext)sat the end of the output template - download from websites that you trust
- do not download to a directory within the executable search
PATHor other sensitive locations, such as your user directory or system directories - in Windows versions that support it, set
NoDefaultCurrentDirectoryInExePathto prevent the cmd shell's executable search adding the default directory beforePATH - consider that the path traversal vulnerability as a result of resolving
non_existent_dir\..\..\targetdoes not exist in Linux or macOS - ensure the extension of the media to download is a common video/audio/... one (use
--get-filename) - omit any of the subtitle options (
--write-subs/--write-srt,--write-auto-subs/--write-automatic-subs,--all-subs).
References
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | youtube-dl | ≥ 2015.01.25 | No fix |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for youtube-dl. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Remediation status
No patched version of youtube-dl has shipped for GHSA-22fp-mf44-f2mq yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Mitigate without a patch
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-22fp-mf44-f2mq is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-22fp-mf44-f2mq. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-22fp-mf44-f2mq in your dependencies?
O3 detects GHSA-22fp-mf44-f2mq across PyPI dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.