CVE-2023-46121

Summary

CVE-2023-46121 is a vulnerability affecting the Generic Extractor in yt-dlp, a popular YouTube downloader. An attacker can exploit this issue by setting an arbitrary proxy for a request to any URL, enabling them to Man-in-the-Middle (MITM) the request made from yt-dlp's HTTP session. This could potentially result in cookie exfiltration. To mitigate this risk, version 2023.11.14 of yt-dlp disables the ability to pass custom headers to the Generic extractor, as well as other extractors using the same pattern. Users unable to upgrade are advised to disable the Generic extractor or limit its usage to trusted sites with verified content, and be cautious when employing the `--no-check-certificate` option.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.