Main Vulnerability Database Vulnerabilities #VU93640

Input validation error in yt-dlp - CVE-2024-38519

Published: July 2, 2024

Vulnerability identifier: #VU93640

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-38519

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to software allows files with insecure extensions to be stored in the download folder. A remote attacker can trick the victim to download an executable file and execute it on the system.

Affected software

yt-dlp
Fedora
yt-dlp

How to mitigate CVE-2024-38519

Install updates from vendor's website.

yt-dlp - update to 2024.07.01
yt-dlp - addressed in versions 2024.07.02-1.fc39, 2024.07.02-1.fc40, 2024.07.07-1.fc39, 2024.07.09-1.fc39

External References

https://github.com/yt-dlp/yt-dlp/releases/tag/2024.07.01
https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-79w7-vh3h-8g4j

Related Security Bulletins