From Global Allowlist to RCE: Breaking Down CVE-2026-50023 in yt-dlp | HackerNoon

How a shortcut-extension exception in yt-dlp’s CVE-2024-38519 fix opened the door to CVE-2026-50023, and what the follow-up bug teaches us.