CVE-2025-54072
highpriority · track · 32EPSS 0.006 · 51 %ileEUUSEPSS · scored 2026-10-28
yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder (or {}), insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the mitigation for CVE-2024-22423 where the default placeholder and {} were not covered by the new escaping rules. Windows users who are unable to upgrade should avoid using --exec altogether. Instead, the --write-info-json or --dump-json options could be used, with an external script or command line consuming the JSON output. This is fixed in version 2025.07.21.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (12)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2025-54072cnnvd
- https://github.com/yt-dlp/yt-dlp/commit/959ac99e98c3215437e573c22d64be42d361e863cnnvd
- https://github.com/yt-dlp/yt-dlp/releasesPatchcnnvd
- https://github.com/yt-dlp/yt-dlp/releases/tag/2025.07.21cnnvd
- https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-45hg-7f49-5h56cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2025-54072cnnvd
- https://github.com/yt-dlp/yt-dlp/commit/959ac99e98c3215437e573c22d64be42d361e863enisa_euvd
- https://github.com/yt-dlp/yt-dlp/releases/tag/2025.07.21enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan