Security4 hOctober 7, 2026, 02:26

yt-dlp RCE via .desktop files in HLS subtitles disclosed as CVE-2026-50023

A researcher detailed CVE-2026-50023 in yt-dlp: a global extension allowlist treated .desktop, .url and .webloc as peers of .srt. An HLS manifest with a subtitle URI ending in .desktop caused an executable shortcut to be written to the download folder. The fix shipped in version 2026.06.09.

HackerNoon

Open source

Affects yt-dlp versions below 2026.06.09
Exploit needs only --write-subs, not --write-link
Patch removed .desktop, .url and .webloc from global ALLOWED_EXTENSIONS
Fix by Grub4K, reviewed by bashonly

#Yt-dlp

IFPI Wants yt-dlp on EU Piracy Watch List

Security

Hackers spoof US HR platforms with fake desktop apps to gain remote access

Security

Fake payroll desktop apps give attackers a route to company paychecks

Security

yt-dlp RCE via .desktop files in HLS subtitles disclosed as CVE-2026-50023

IFPI Wants yt-dlp on EU Piracy Watch List

Hackers spoof US HR platforms with fake desktop apps to gain remote access

Fake payroll desktop apps give attackers a route to company paychecks

Codex Desktop flaw let untrusted code read auth tokens from shared memory