{
  "cveId": "CVE-2024-38519",
  "url": "https://patchblox.com/security/cve/CVE-2024-38519",
  "summary": "CVE-2024-38519 is fixed in yt-dlp on 1 platform, first by DEBIAN-CVE-2024-38519, released July 2, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "yt-dlp: \u0060yt-dlp\u0060 and \u0060youtube-dl\u0060 are command-line audio/video downloaders",
  "description": "\u0060yt-dlp\u0060 and \u0060youtube-dl\u0060 are command-line audio/video downloaders. Prior to the fixed versions,\u00A0\u0060yt-dlp\u0060 and \u0060youtube-dl\u0060 do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows). Since \u0060yt-dlp\u0060 and \u0060youtube-dl\u0060 also read config from the working directory (and on Windows executables will be executed from the \u0060yt-dlp\u0060 or \u0060youtube-dl\u0060 directory), this could lead to arbitrary code being executed.     \u0060yt-dlp\u0060 version 2024.07.01 fixes this issue by whitelisting the allowed extensions. \u0060youtube-dl\u0060 fixes this issue in commit \u0060d42a222\u0060 on the \u0060master\u0060 branch and in nightly builds tagged 2024-07-03 or later. This might mean some very uncommon extensions might not get downloaded, however it will also limit the possible exploitation surface. In addition to upgrading, have \u0060.%(ext)s\u0060 at the end of the output template and make sure the user trusts the websites that they are downloading from. Also, make sure to never download to a directory within PATH or other sensitive locations like one\u0027s user directory, \u0060system32\u0060, or other binaries locations. For users who are not able to upgrade, keep the default output template (\u0060-o \u0022%(title)s [%(id)s].%(ext)s\u0060); make sure the extension of the media to download is a common video/audio/sub/... one; try to avoid the generic extractor; and/or use \u0060--ignore-config --config-location ...\u0060 to not load config from common locations.",
  "published": "2024-07-02T14:15:13Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "epss": 0.00325,
  "epssPercentile": 0.25669,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "yt-dlp",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2024.07.01-1",
      "fix": "DEBIAN-CVE-2024-38519",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-38519",
      "released": "2024-07-02T14:15:13Z"
    },
    {
      "platform": "linux",
      "product": "yt-dlp",
      "release": "Debian 14",
      "fixedVersion": "2024.07.01-1",
      "fix": "DEBIAN-CVE-2024-38519",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-38519",
      "released": "2024-07-02T14:15:13Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}