CVE-2025-54072 – Yt-dlp Windows Remote Code Execution Vulnerability

CVE ID : CVE-2025-54072

Published : July 22, 2025, 10:15 p.m. | 44 minutes ago

Description : yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the –exec option is used on Windows with the default placeholder (or {}), insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the mitigation for CVE-2024-22423 where the default placeholder and {} were not covered by the new escaping rules. Windows users who are unable to upgrade should avoid using –exec altogether. Instead, the –write-info-json or –dump-json options could be used, with an external script or command line consuming the JSON output. This is fixed in version 2025.07.21.

Severity: 7.5 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…