CVE-2023-40581

Summary

CVE-2023-40581 is a new vulnerability affecting yt-dlp, a popular YouTube downloader. This issue arises from the `--exec` flag's ability to execute shell commands with output template expansion, which can lead to remote code execution on Windows due to improper escaping. The vulnerability exists regardless of the command line interface (cmd or PowerShell) used. It was introduced in version 2021.04.11 and is specific to yt-dlp on Windows. To mitigate the risk, users are advised to upgrade to version 2023.09.24, which addresses the escaping issue. Windows users unable to upgrade should avoid using output template expansion in `--exec` and verify the fields used do not contain special characters like ", |, or &. Additionally, users can opt to write the info json and load the fields from it instead of using `--exec`.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.