CVE-2025-54072: yt-dlp allows `--exec` command injection when using placeholder on Windows
yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder (or {}), insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the mitigation for CVE-2024-22423 where the default placeholder and {} were not covered by the new escaping rules. Windows users who are unable to upgrade should avoid using --exec altogether. Instead, the --write-info-json or --dump-json options could be used, with an external script or command line consuming the JSON output. This is fixed in version 2025.07.21.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54072?
CVE-2025-54072 has been classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2025-54072?
To mitigate CVE-2025-54072, upgrade to yt-dlp version 2025.07.21 or later where the vulnerability has been addressed.
Who is affected by CVE-2025-54072?
CVE-2025-54072 affects all users of yt-dlp versions 2025.06.25 and below when using the --exec option on Windows.
What kind of attacks can exploit CVE-2025-54072?
CVE-2025-54072 can be exploited to execute arbitrary code remotely by manipulating the expanded filepath during the execution of commands.
Is it safe to use yt-dlp on Windows if I have not updated since version 2025.06.25?
No, it is unsafe to use yt-dlp on Windows without updating from version 2025.06.25 due to the existence of the critical vulnerability.