CVE-2025-54072
📋 TL;DR
This vulnerability allows remote code execution on Windows systems when using yt-dlp with the --exec option and default placeholder. Attackers can craft malicious filenames that bypass sanitization, executing arbitrary commands. Only Windows users of yt-dlp versions 2025.06.25 and below who use the --exec option are affected.
💻 Affected Systems
- yt-dlp
📦 What is this software?
Yt Dlp by Yt Dlp Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the Windows machine, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation or execution of arbitrary commands in the context of the yt-dlp user, potentially leading to data exfiltration or installation of malware.
If Mitigated
No impact if --exec option is avoided or proper input validation is implemented through external scripts.
🎯 Exploit Status
Exploitation requires user to download maliciously named files and use --exec option. This is a bypass of previous CVE-2024-22423 mitigation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2025.07.21
Vendor Advisory: https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-45hg-7f49-5h56
Restart Required: No
Instructions:
1. Upgrade yt-dlp to version 2025.07.21 or later using: pip install --upgrade yt-dlp
2. Verify installation with: yt-dlp --version
3. No system restart required.
🔧 Temporary Workarounds
Avoid --exec option
windowsCompletely avoid using the --exec option on Windows systems
Do not use --exec in any yt-dlp commands
Use JSON output with external processing
allUse --write-info-json or --dump-json options and process output with external scripts
yt-dlp --write-info-json <URL>
yt-dlp --dump-json <URL>
🧯 If You Can't Patch
- Immediately stop using --exec option on all Windows systems
- Implement strict file naming policies and input validation for downloaded content
🔍 How to Verify
Check if Vulnerable:
Check yt-dlp version with: yt-dlp --version. If version is 2025.06.25 or below and you use --exec on Windows, you are vulnerable.Check Version:
yt-dlp --versionVerify Fix Applied:
After upgrade, verify version is 2025.07.21 or higher with: yt-dlp --version📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns from yt-dlp process
- Suspicious file operations following yt-dlp downloads
Network Indicators:
- Outbound connections from yt-dlp process to unexpected destinations
- DNS queries for command and control domains
SIEM Query:
process_name:yt-dlp AND command_line:*--exec* AND os:Windows