A critical command injection vulnerability in yt-dlp on Windows systems allows unauthenticated attackers to achieve remote code execution via the --exec option.

This is an OS Command Injection vulnerability (CWE-78) occurring when the --exec option is utilized on Windows platforms. The application fails to properly sanitize the expanded filepath when using default placeholders, permitting an attacker to execute arbitrary commands on the host system.

Successful exploitation of this vulnerability leads to full remote code execution on the host machine, which can result in complete system compromise, data exfiltration, and lateral movement within the network. With a CVSS score of 7.5, the risk is classified as High, reflecting the potential for significant impact despite the requirement for user interaction and specific configuration settings.

Immediate Action: Upgrade the yt-dlp software to version 2025.07.21 or later to apply the necessary input sanitization patches.

Proactive Monitoring: Review system logs and command-line history for unexpected executions or suspicious process spawning originating from the yt-dlp binary.

Compensating Controls: Windows users unable to update immediately should cease using the --exec option entirely, opting instead for --write-info-json or --dump-json to process data through secure, external scripts.

Public Exploit Available: Unknown

Given the severity of potential remote code execution, organizations utilizing yt-dlp on Windows environments must prioritize updating to the patched version. If an immediate update is not feasible, the recommended compensating control of disabling the --exec functionality is essential to prevent unauthorized command execution until the patch can be deployed.