{"action":"Upgrade yt-dlp to 0-r0 or later.","affected":[{"introduced":"0"}],"component":"yt-dlp","cve_ids":[],"ecosystem":"Alpine","ecosystem_qualifier":"Alpine:v3.24","exploited":false,"fixed_versions":["0-r0"],"id":"tcs_01M6H15RE9VJZ2CSJMFYEH355K","modified_at":"2026-11-03T06:32:52.019538590Z","published_at":"2025-07-22T22:15:37.943Z","references":["https://osv.dev/vulnerability/ALPINE-CVE-2025-54072","https://security.alpinelinux.org/vuln/CVE-2025-54072"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"ALPINE-CVE-2025-54072#Alpine:v3.24/yt-dlp","url":"https://osv.dev/vulnerability/ALPINE-CVE-2025-54072"}],"summary":"yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder (or {}), insufficient sanitizatio"}