By vendor

Yt-Dlp_project vulnerabilities

Known CVEs affecting Yt-Dlp_project products, prioritized by severity, with SEC.co remediation and detection guidance.

3 published vulnerabilities

• CVE-2026-50023HIGH 8.3

  yt-dlp, a popular command-line tool for downloading audio and video, contains a flaw that allows attackers to plant malicious shortcut files on your system when you download media or subtitles. The vulnerability bypasses a previous security fix by exploiting an allowlist that was meant to preserve legitimate functionality. An attacker could use this to execute code or trick you into running harmful files embedded as .desktop, .url, or .webloc shortcuts.

• CVE-2026-50574HIGH 8.3

  yt-dlp, a popular command-line tool for downloading audio and video from the web, contains a security flaw that allows attackers to write arbitrary files to a system when the aria2c external downloader is used with fragmented video formats like HLS or DASH streams. On Windows, this can lead to immediate code execution; on other platforms, malicious code would execute the next time yt-dlp runs. The vulnerability was patched in version 2026.06.09.

• CVE-2026-50019MEDIUM 6.1

  yt-dlp is a popular command-line tool for downloading audio and video from the web. Between September 2023 and June 2026, a vulnerability existed where cookies could be sent to the wrong website if yt-dlp was configured to use curl as its external downloader. This could happen during HTTP redirects or when downloading video fragments from different hosts than the main manifest. The flaw stems from how yt-dlp passes cookies to curl—without properly activating curl's cookie handling engine, curl will blindly send cookies to any domain it connects to, regardless of the cookie's intended scope. An attacker controlling a redirect target or hosting a fragment URL could intercept these cookies, potentially gaining access to authenticated sessions. The vulnerability was fixed in version 2026.06.09.