GHSA-69QJ-PVH9-C5WG: Command Injection in yt-dlp --exec Option

Vulnerability ID: GHSA-69QJ-PVH9-C5WG
CVSS Score: 7.5
Published: 2026-06-16

An OS command injection vulnerability in yt-dlp before 2026.06.09 allows unauthenticated remote attackers to execute arbitrary shell commands via crafted media metadata when a user processes media using the --exec post-processing parameter with unsafe string interpolation conversions.

TL;DR

Unsafe metadata interpolation in yt-dlp's post-processor allows remote command execution when downloading maliciously crafted media links with custom command execution templates.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-78
• Attack Vector: Network
• CVSS v3.1: 7.5 (High)
• Exploit Status: Proof-of-Concept
• CISA KEV Status: Not Listed
• Patched Version: 2026.06.09

Affected Systems

• yt-dlp command-line downloader utility
• yt-dlp: >= 2021.04.11, < 2026.06.09 (Fixed in: 2026.06.09)

Code Analysis

Commit: 5faffa9

Fix command execution safety checks for prepare_outtmpl by restricting allowed format specifiers and default templates in exec context.

Exploit Details

• GitHub Security Advisory PoC: Demonstrative Python unit-test simulating metadata replacement to spawn shell-based command files.

Mitigation Strategies

• Upgrade to yt-dlp version 2026.06.09 or newer.
• Replace unsafe string interpolation formats like %()s with %()q inside executive templates.
• Avoid running user-supplied command execution parameters with unvetted input links.

Remediation Steps:

1. Run 'pip install --upgrade yt-dlp' to pull the patched code.
2. Search configuration files and terminal history for usages of '--exec'.
3. Audit execution parameters and rewrite template conversion identifiers to use shell-quoted variants.
4. Verify that '--compat-options allow-unsafe-exec-expansion' is not enabled.

References

• GitHub Security Advisory GHSA-69qj-pvh9-c5wg
• yt-dlp Pull Request #16883
• Fix Commit 5faffa9
• yt-dlp Version 2026.06.09 Release Notes

Read the full report for GHSA-69QJ-PVH9-C5WG on our website for more details including interactive diagrams and full exploit analysis.