PyPI package
yt-dlp
pkg:pypi/yt-dlp
Vulnerabilities (6)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-26331 | — | >= 2023.06.21, < 2026.02.21 | 2026.02.21 | Feb 24, 2026 | yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter) is used, an attacker could achieve arbitrary command injection on the user's syst | ||
| CVE-2024-38519 | Hig | 7.8 | < 2024.07.01 | 2024.07.01 | Jul 2, 2024 | `yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows) | |
| CVE-2024-22423 | — | >= 2021.04.11, < 2024.04.09 | 2024.04.09 | Apr 9, 2024 | yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using `--exec` with `%q` by replacing double quotes with two double quotes. However, this escaping is not sufficient, and still allows expansion o | ||
| CVE-2023-46121 | — | >= 2022.10.04, < 2023.11.14 | 2023.11.14 | Nov 14, 2023 | yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP session. This could lead to | ||
| CVE-2023-40581 | — | >= 2021.04.11, < 2023.09.24 | 2023.09.24 | Sep 25, 2023 | yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the `--exec` flag. This flag allows output template expansion in its argument, so that metadata val | ||
| CVE-2023-35934 | — | < 2023.7.06 | 2023.7.06 | Jul 6, 2023 | yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent |
- CVE-2026-26331Feb 24, 2026affected >= 2023.06.21, < 2026.02.21fixed 2026.02.21
yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter) is used, an attacker could achieve arbitrary command injection on the user's syst
- affected < 2024.07.01fixed 2024.07.01
`yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path traversal on Windows)
- CVE-2024-22423Apr 9, 2024affected >= 2021.04.11, < 2024.04.09fixed 2024.04.09
yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using `--exec` with `%q` by replacing double quotes with two double quotes. However, this escaping is not sufficient, and still allows expansion o
- CVE-2023-46121Nov 14, 2023affected >= 2022.10.04, < 2023.11.14fixed 2023.11.14
yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP session. This could lead to
- CVE-2023-40581Sep 25, 2023affected >= 2021.04.11, < 2023.09.24fixed 2023.09.24
yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the `--exec` flag. This flag allows output template expansion in its argument, so that metadata val
- CVE-2023-35934Jul 6, 2023affected < 2023.7.06fixed 2023.7.06
yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent