CVE-2025-54072

Katalog CVE

CVSS 8.1 · High EPSS 0,61%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada yt-dlp project yt-dlp. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder (or {}), insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the mitigation for CVE-2024-22423 where the default placeholder and {} were not covered by the new escaping rules. Windows users who are unable to upgrade should avoid using --exec altogether. Instead, the --write-info-json or --dump-json options could be used, with an external script or command line consuming the JSON output. This is fixed in version 2025.07.21.

Rincian

Terbit di NVD

22 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-45hg-7f49-5h56 advisory vendor
• https://github.com/yt-dlp/yt-dlp/commit/959ac99e98c3215437e573c22d64be42d361e863 patch
• https://github.com/yt-dlp/yt-dlp/releases/tag/2025.07.21 release notes