CVE-2024-22423 [High] | Command Injection in Yt-Dlp

yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using `--exec` with `%q` by replacing double quotes with two double quotes. However, this escaping is not sufficient, and still allows expansion of environment variables. Support for output template expansion in `--exec`, along with this vulnerable behavior, was added to `yt-dlp` in version 2021.04.11. yt-dlp version 2024.04.09 fixes this issue by properly escaping `%`. It replaces them with `%%cd:~,%`, a variable that expands to nothing, leaving only the leading percent. It is recommended to upgrade yt-dlp to version 2024.04.09 as soon as possible. Also, always be careful when using `--exec`, because while this specific vulnerability has been patched, using unvalidated input in shell commands is inherently dangerous. For Windows users who are not able to upgrade, avoid using any output template expansion in `--exec` other than `{}` (filepath); if expansion in `--exec` is needed, verify the fields you are using do not contain `"`, `|` or `&`; and/or instead of using `--exec`, write the info json and load the fields from it instead.

EDB-ID	Source	Kind	Published	Link
—	nvd_ref	exploit_tag		Exploit-DB ↗

EDB-ID

Source

Kind

Published

Link

—

nvd_ref

exploit_tag

Exploit-DB ↗

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-05-07	6.66%	6.50%	-0.17%
2	2026-04-28	5.03%	6.66%	+1.63%
3	2026-04-24	—	5.03%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-05-07

6.66%

6.50%

-0.17%

2026-04-28

5.03%

6.66%

+1.63%

2026-04-24

—

5.03%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
8.3	3.1	HIGH	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:R) A real person has to do something—click, install, enable—otherwise it doesn’t land. Scope (S:C) Breaking this can reach past the original component and bite other resources—bigger blast radius. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.6	6.0	[email protected]
9.8	3.1	CRITICAL	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	3.9	5.9	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

8.3

3.1

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H): Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:R): A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:C): Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.6

6.0

[email protected]

9.8

3.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

3.9

5.9

[email protected]

OS Trackers for CVE-2024-22423

vendor	priority	summary	link
`alpine`	—	CVE-2024-22423: 1 source package rows (yt-dlp); 11 state rows across 5 repos (3.19-community, 3.20-community, 3.21-community, 3.22-community, edge-community); fixed 10, open 1.	https://security.alpinelinux.org/vuln/CVE-2024-22423
`debian`	unimportant	CVE-2024-22423 unimportant priority: Debian including 1 source packages (yt-dlp), 4 status rows across 4 suites (bookworm, forky, sid, trixie): resolved 4.	https://security-tracker.debian.org/tracker/CVE-2024-22423
`ubuntu`	medium	CVE-2024-22423 medium priority: Ubuntu including 1 source packages (yt-dlp), 8 status rows across 8 suites (focal, jammy, mantic, noble, oracular, plucky, questing, upstream): ignored 3, needs-triage 3, DNE 1, not-affected 1.	https://ubuntu.com/security/CVE-2024-22423

Affected software / configurations for CVE-2024-22423

Vendor	Product	Version	Raw CPE
yt-dlp_project	yt-dlp	>= 2021.04.11, < 2024.04.09	cpe:2.3:a:yt-dlp_project:yt-dlp::::::::

References for CVE-2024-22423

URL	Tags
https://github.com/yt-dlp/yt-dlp/commit/de015e930747165dbb8fcd360f8775fd973b7d6e	Patch
https://github.com/yt-dlp/yt-dlp/commit/ff07792676f404ffff6ee61b5638c9dc1a33a37a	Patch
https://github.com/yt-dlp/yt-dlp/releases/tag/2021.04.11	Product Release Notes
https://github.com/yt-dlp/yt-dlp/releases/tag/2024.04.09	Product Release Notes
https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-42h4-v29r-42qg	Not Applicable
https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-hjq6-52gw-2g7p	Exploit Vendor Advisory
https://www.kb.cert.org/vuls/id/123335	Third Party Advisory

URL

CVE-2024-22423 | yt-dlp `--exec` command injection when using `%q` in yt-dlp on Windows

Public exploit references (Exploit-DB) for CVE-2024-22423

Exploit prediction scoring system (EPSS) score for CVE-2024-22423

Common vulnerability scoring system (CVSS) metrics for CVE-2024-22423

Weakness enumeration for CVE-2024-22423

GitHub Security Advisory for CVE-2024-22423

OS Trackers for CVE-2024-22423

Affected software / configurations for CVE-2024-22423

References for CVE-2024-22423