CVE catalog

CVE-2024-22423

yt-dlp affected and fixed versions

yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using `--exec` with `%q` by replacing double quotes with two double quotes. However, this escaping is not sufficient, and still allows expansion of environment variables. Support for output template expansion in `--exec`, along with this vulnerable behavior, was added to `yt-dlp` in version 2021.04.11. yt-dlp version 2024.04.09 fixes this issue by properly escaping `%`. It replaces them with `%%cd:~,%`, a variable that expands to nothing, leaving only the leading percent. It is recommended to upgrade yt-dlp to version 2024.04.09 as soon as possible. Also, always be careful when using `--exec`, because while this specific vulnerability has been patched, using unvalidated input in shell commands is inherently dangerous. For Windows users who are not able to upgrade, avoid using any output template expansion in `--exec` other than `{}` (filepath); if expansion in `--exec` is needed, verify the fields you are using do not contain `"`, `|` or `&`; and/or instead of using `--exec`, write the info json and load the fields from it instead.

Severity: Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Apr 9, 2024, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.43% · Oct 27, 2026

Projects and upstream resources

[yt-dlp][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Opensusetumbleweed	yt-dlp	`2024.04.09-1.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2024:13854-1]Feb 4, 2026, 3:06:14 AM UTC
Debiantrixie	yt-dlp	Not reported	Not affectedDistribution reports not affected	[CVE-2024-22423]
Debiantrixie	yt-dlp	`2025.04.30-1`	Not affected	[CVE-2024-22423]
Debiansid	yt-dlp	Not reported	Not affectedDistribution reports not affected	[CVE-2024-22423]
Debiansid	yt-dlp	`2026.10.26-1`	Not affected	[CVE-2024-22423]
Debianforky	yt-dlp	Not reported	Not affectedDistribution reports not affected	[CVE-2024-22423]
Debianforky	yt-dlp	`2026.10.21-1`	Not affected	[CVE-2024-22423]
Debianbookworm	yt-dlp	Not reported	Not affectedDistribution reports not affected	[CVE-2024-22423]
Debianbookworm	yt-dlp	`2023.03.04-1`	Not affected	[CVE-2024-22423]
PyPIRelease not reported	yt-dlp	`2024.04.09`	UnknownSource applicability is not established	Provider not reported

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
PyPIRelease not reported	yt-dlp	`2024.04.09`	UnknownSource applicability is not established	Provider not reported
Debianbookworm	yt-dlp	Not reported	Not affectedDistribution reports not affected	[CVE-2024-22423]
Debianbookworm	yt-dlp	`2023.03.04-1`	Not affected	[CVE-2024-22423]
Debianforky	yt-dlp	Not reported	Not affectedDistribution reports not affected	[CVE-2024-22423]
Debianforky	yt-dlp	`2026.10.21-1`	Not affected	[CVE-2024-22423]
Debiansid	yt-dlp	Not reported	Not affectedDistribution reports not affected	[CVE-2024-22423]
Debiansid	yt-dlp	`2026.10.26-1`	Not affected	[CVE-2024-22423]
Debiantrixie	yt-dlp	Not reported	Not affectedDistribution reports not affected	[CVE-2024-22423]
Debiantrixie	yt-dlp	`2025.04.30-1`	Not affected	[CVE-2024-22423]
Opensusetumbleweed	yt-dlp	`2024.04.09-1.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2024:13854-1]Feb 4, 2026, 3:06:14 AM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "yt-dlp",
      "status": "not affected",
      "release": "sid",
      "version": "2026.10.26-1"
    },
    {
      "name": "yt-dlp",
      "status": "not affected",
      "release": "forky",
      "version": "2026.10.21-1"
    },
    {
      "name": "yt-dlp",
      "status": "not affected",
      "release": "trixie",
      "version": "2025.04.30-1"
    },
    {
      "name": "yt-dlp",
      "status": "not affected",
      "release": "bookworm",
      "version": "2023.03.04-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "yt-dlp",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "yt-dlp",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "yt-dlp",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "yt-dlp",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": "0"
    }
  ],
  "distribution_packages": [
    {
      "name": "yt-dlp",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2021.04.11"
            },
            {
              "fixed": "2024.04.09"
            }
          ]
        }
      ],
      "ecosystem": "PyPI",
      "fixed_version": "2024.04.09",
      "applicability_unknown": true
    },
    {
      "name": "yt-dlp",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2024.04.09-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2024:13854-1",
      "fixed_version": "2024.04.09-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2024:13854-1",
      "provider_updated_at": "2026-02-04T03:06:14.148422Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[yt-dlp]Unknown
Details (4)
- 2023.03.04-1 · all · bookworm
  Not affected
  dsa · yt-dlp · debian · bookworm
- 2023.03.04-1 · all · bookworm
  Not affected
  dsa · yt-dlp · debian · bookworm
- 2025.04.30-1~bpo12+1 · all · bookworm-backports
  Not affected
  dsa · yt-dlp · debian · bookworm
- 2025.04.30-1~bpo12+1 · all · bookworm-backports
  Not affected
  dsa · yt-dlp · debian · bookworm

[openSUSE Tumbleweed]

[python313-yt-dlp]Unknown
Source package: [yt-dlp]
Details (1)
- 2026.08.19-1.1 · noarch · tumbleweed
  Unknown · Fixed: 2024.04.09-1.1
  Version impact unknown
  dsa · yt-dlp · opensuse · tumbleweed
[yt-dlp]Unknown
Source package: [yt-dlp]
Details (1)
- 2026.08.19-1.1 · noarch · tumbleweed
  Fixed · Fixed: 2024.04.09-1.1
  dsa · yt-dlp · opensuse · tumbleweed
[yt-dlp-youtube-dl]Unknown
Source package: [yt-dlp]
Details (1)
- 2026.08.19-1.1 · noarch · tumbleweed
  Unknown · Fixed: 2024.04.09-1.1
  Version impact unknown
  dsa · yt-dlp · opensuse · tumbleweed

Observed: Oct 27, 2026, 3:32:04 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]