How severe is CVE-2026-50023?

CVE-2026-50023 has a CVSS 3.x base score of 8.3, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-50023 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (42nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-50023?

CVE-2026-50023 affects Yt-dlp Project Yt-dlp. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-50023?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-50023 have an EU (EUVD) identifier?

Yes. CVE-2026-50023 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-38493.

When was CVE-2026-50023 published?

CVE-2026-50023 was published on 2026-06-23 and last updated on 2026-06-26.

CVE-2026-50023

CVE-2026-50023 is a high-severity vulnerability in Yt-dlp Project Yt-dlp with a CVSS 3.x base score of 8.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-641.

Key facts

Severity: High (CVSS 3.x base score 8.3)
EPSS exploit prediction: 1% (42nd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-38493
Weakness: CWE-641
Affected product: Yt-dlp Project Yt-dlp
Published: 2026-06-23
Last modified: 2026-06-26

Description

yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519. The allowlist explicitly included the unsafe extensions .desktop, .url, and .webloc so that the functionality of the --write-link option (and its variants) could be preserved. These allowlist inclusions can be exploited by an attacker to write malicious OS-shortcut files in the context of a media or subtitles download. This vulnerability is fixed in 2026.06.09.

Frequently asked questions

What is CVE-2026-50023?: yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519. The allowlist explicitly included the unsafe extensions .desktop, .url, and .webloc so that the functionality of the --write-link option (and its variants) could be preserved. These allowlist inclusions can be exploited by an attacker to write malicious OS-shortcut files in the context of a media or subtitles download. This vulnerability is fixed in 2026.06.09.
How severe is CVE-2026-50023?: CVE-2026-50023 has a CVSS 3.x base score of 8.3, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-50023 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (42nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-50023?: CVE-2026-50023 affects Yt-dlp Project Yt-dlp. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-50023?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-50023 have an EU (EUVD) identifier?: Yes. CVE-2026-50023 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-38493.
When was CVE-2026-50023 published?: CVE-2026-50023 was published on 2026-06-23 and last updated on 2026-06-26.

References

Affected products (1)

cpe:2.3:a:yt-dlp_project:yt-dlp:*:*:*:*:*:*:*:*

More vulnerabilities in Yt-dlp Project Yt-dlp

CVE-2024-3566 — Critical (CVSS 9.8): A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly…
CVE-2026-26331 — High (CVSS 8.8): yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when…
CVE-2026-50574 — High (CVSS 8.3): yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an external downloader for a…
CVE-2024-22423 — High (CVSS 8.3): yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to…
CVE-2023-40581 — High (CVSS 8.3): yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines…
CVE-2025-54072 — High (CVSS 7.5): yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option…

All CVEs affecting Yt-dlp Project Yt-dlp →

Other CWE-641 vulnerabilities

CVE-2026-25177 — High (CVSS 8.8): Improper restriction of names for files and other resources in Active Directory Domain Services allows an authorized…
CVE-2025-47953 — High (CVSS 8.4): Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2025-47173 — High (CVSS 7.8): Improper input validation in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2025-21402 — High (CVSS 7.8): Microsoft Office OneNote Remote Code Execution Vulnerability
CVE-2025-21361 — High (CVSS 7.8): Microsoft Outlook Remote Code Execution Vulnerability
CVE-2023-0046 — High (CVSS 7.2): Improper Restriction of Names for Files and Other Resources in GitHub repository lirantal/daloradius prior to…

Browse all CWE-641 vulnerabilities →