GHSA-3v33-3wmw-3785: yt-dlp has dependency on potentially malicious third-party code in Douyu extractors
yt-dlp’s DouyuTV and DouyuShow extractors used a cdn.bootcdn.net
URL as a fallback for fetching a component of the crypto-js JavaScript library. When the Douyu extractor is used, yt-dlp extracts this JavaScript code and attempts to execute it externally using PhantomJS. bootcdn.net
is owned by the bad actor responsible for the Polyfill JS supply chain attack that has been ongoing since at least June 2023. While there is no evidence that PhantomJS has been targeted by or is vulnerable to any attacks carried out by the Polyfill JS actor, there is the possibility that malicious JavaScript code may have been downloaded/cached by yt-dlp or executed by PhantomJS.
In order for this potential vulnerability to be exploited by any hypothetical attack, all 3 of the following conditions must be met:
- The user has PhantomJS installed on their system.
- The user passes a
douyu.com
ordouyutv.com
URL to yt-dlp as input, or passes a URL that redirects to one of these domains. cdnjs.cloudflare.com
is unavailable or blocked at the time of extraction, necessitating the usage of thecdn.bootcdn.net
fallback; or it had been unavailable during a previous run of the Douyu extractor and JavaScript code fromcdn.bootcdn.net
had been cached to disk.
References
Detect and mitigate GHSA-3v33-3wmw-3785 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →