diff options
| author | Simon Sawicki <contact@grub4k.xyz> | 2024-04-08 23:18:04 +0200 |
|---|---|---|
| committer | Simon Sawicki <contact@grub4k.xyz> | 2024-04-09 18:36:13 +0200 |
| commit | ff07792676f404ffff6ee61b5638c9dc1a33a37a (patch) | |
| tree | 6b973d54eeef6c75f80795a3611cf494cc192e4a /test/test_networking_utils.py | |
| parent | 216f6a3cb57824e6a3c859649ce058c199b1b247 (diff) | |
[core] Prevent RCE when using `--exec` with `%q` (CVE-2024-22423)
The shell escape function now properly escapes `%`, `\\` and `\n`. `utils.Popen` as well as `%q` output template expansion have been patched accordingly.
Prior to this fix using `--exec` together with `%q` when on Windows could cause remote code to execute. See https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-hjq6-52gw-2g7p for more details.
Authored by: Grub4K
Diffstat (limited to 'test/test_networking_utils.py')
0 files changed, 0 insertions, 0 deletions