Detections
Analytics

SCA: security update for yt-dlp (GHSA-c6mh-fpjc-4pr3)

critical Tenable Cloud Security Plugin ID 443335

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp
 that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to
 the user's filesystem, bypassing the remediation for CVE-2024-38519. The allowlist explicitly included the
 unsafe extensions .desktop, .url, and .webloc so that the functionality of the --write-link option (and
 its variants) could be preserved. These allowlist inclusions can be exploited by an attacker to write
 malicious OS-shortcut files in the context of a media or subtitles download. This vulnerability is fixed
 in 2026.06.09. (CVE-2026-50023)

Solution

Update the yt-dlp library and its related packages to version 2026.6.9 or later.

See Also

https://github.com/advisories/GHSA-c6mh-fpjc-4pr3

Plugin Details

Severity: Critical

ID: 443335

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 6/17/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.18

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-50023

CVSS v3

Risk Factor: Critical

Base Score: 9.6

Temporal Score: 8.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/16/2026

Vulnerability Publication Date: 6/16/2026

Reference Information

CVE: CVE-2026-50023

cwe: CWE-641