CVE-2026-50019: yt-dlp Cookie Leak via curl External Downloader

Technical summary

The vulnerability resides in yt-dlp's cookie handling when delegating downloads to curl. When cookies are supplied via command-line arguments (rather than loaded from a file), yt-dlp does not activate curl's built-in cookie engine. Without proper cookie jar initialization and scope validation in curl, the raw cookie string passed via --cookie argument causes curl to send those cookies indiscriminately to all request targets, violating HTTP cookie scope restrictions (domain, path, secure flag). This creates a window for cross-domain cookie leakage during redirect chains or when HLS/DASH manifest fragments are served from different hosts. The root cause is the absence of cookie jar context enforcement between the parent manifest host and fragment download hosts.

Business impact

For organizations using yt-dlp with curl for automated bulk downloading (common in media, research, and archival workflows), this vulnerability could expose session tokens or authentication cookies to untrusted servers. If yt-dlp is used in environments processing authenticated feeds or premium content sources, attackers could hijack those sessions. The risk is particularly acute in CI/CD pipelines or scheduled download jobs that may run unattended against mixed or untrusted content sources. Downstream systems relying on the integrity of downloaded content could also be affected if an attacker intercepts and modifies fragments.

Affected systems

yt-dlp versions from 2023.09.24 through 2026.06.08 are vulnerable when curl is the configured external downloader. Systems using yt-dlp's default downloader (Python urllib) are not affected. The vulnerability only manifests when: (1) curl is explicitly set as the external downloader, (2) cookies are passed via command-line arguments or environment, and (3) the download involves HTTP redirects or fragment requests to differing hosts. Linux, macOS, and Windows installations of yt-dlp are equally affected if they meet these conditions.

Exploitability

Exploitation requires user interaction—specifically, a user must initiate a download targeting a URL controlled or redirected by the attacker, or the manifest must reference fragments on an attacker-controlled domain. An attacker cannot remotely trigger vulnerable downloads; they must wait for a victim to download content they have crafted or control. The attack surface is reduced by the fact that many users either do not use curl as their external downloader or do not pass cookies on the command line. However, for those who do (especially in automation contexts), the risk is moderate because the attacker only needs to control a redirect target or fragment host, not the initial manifest server.

Remediation

Upgrade yt-dlp to version 2026.06.09 or later, which implements proper cookie engine activation and scope validation when curl is used as the external downloader. Organizations unable to upgrade immediately should disable curl as the external downloader and rely on yt-dlp's built-in downloader, or avoid passing sensitive cookies via command-line arguments—instead, configure them within curl's native configuration files (e.g., ~/.curl_cookies) if the underlying curl binary supports it. For automated workflows, review the necessity of passing cookies to yt-dlp and consider network-level authentication (VPN, IP allowlisting) as an alternative.

Patch guidance

Apply yt-dlp version 2026.06.09 or any later version as soon as practicable. Organizations on managed distribution channels (Homebrew, apt, pip, etc.) should ensure they are pulling the latest version. Verify the update by running `yt-dlp --version` and confirming the reported version is 2026.06.09 or higher. After patching, no configuration changes are required—the fix is transparent to end users. If you are running yt-dlp in containers or CI/CD pipelines, rebuild base images and redeploy to ensure all instances are updated.

Detection guidance

Monitor yt-dlp process execution for the combination of: (1) invocation with the --external-downloader curl flag, (2) presence of --cookie or --cookies-from-file arguments, and (3) requests to domains different from the manifest host (observable via network flow logs or curl verbose logging). Enable curl verbose mode (-v) on a test instance to confirm whether cookies are being sent to unintended hosts. Check browser DevTools or network monitoring tools if yt-dlp is embedded in a larger application. Review curl access logs if curl is deployed separately; look for Set-Cookie or Cookie headers crossing domain boundaries unexpectedly.

Why prioritize this

This vulnerability merits prompt but not emergency patching. The CVSS score of 6.1 (Medium) reflects the confluence of network accessibility, the requirement for user interaction, and the high confidentiality impact (cookie/session theft). It is not in the CISA KEV catalog, indicating no in-the-wild exploitation has been reported as of publication. However, the specificity of the affected workflow (curl + command-line cookies) and the 2+ year window of exposure mean that some organizations may have unknowingly deployed vulnerable instances. Prioritize patching if your organization uses yt-dlp in automated workflows with credential passing; deprioritize if you rely on yt-dlp's built-in downloader.

Risk score, explained

CVSS 6.1 (Medium) is justified by: (1) network-based attack vector (AV:N), (2) high complexity due to the need to control a redirect target or fragment host (AC:H), (3) no privilege requirement (PR:N), (4) user interaction required to trigger a download (UI:R), (5) scope change because the attacker can affect resources beyond the security scope of the vulnerable component (S:C), and (6) high confidentiality impact via cookie theft (C:H). Integrity and availability are not impacted (I:N, A:N). The score does not account for the narrow conditions (curl must be configured, cookies must be passed on command line), which somewhat elevates the practical risk if you match those conditions.

Frequently asked questions