Vulnerability Description
yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder (or {}), insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This is a bypass of the mitigation for CVE-2024-22423 where the default placeholder and {} were not covered by the new escaping rules. Windows users who are unable to upgrade should avoid using --exec altogether. Instead, the --write-info-json or --dump-json options could be used, with an external script or command line consuming the JSON output. This is fixed in version 2025.07.21.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Yt-Dlp Project | Yt-Dlp | < 2025.07.21 |
Related Weaknesses (CWE)
References
- https://github.com/yt-dlp/yt-dlp/commit/959ac99e98c3215437e573c22d64be42d361e863Patch
- https://github.com/yt-dlp/yt-dlp/releases/tag/2025.07.21Release Notes
- https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-45hg-7f49-5h56Vendor Advisory
FAQ
What is CVE-2025-54072?
CVE-2025-54072 is a vulnerability with a CVSS score of 7.5 (HIGH). yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder (or {}), insufficient sanitizatio...
How severe is CVE-2025-54072?
CVE-2025-54072 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-54072?
Check the references section above for vendor advisories and patch information. Affected products include: Yt-Dlp Project Yt-Dlp.