Every CVE Search/ Get API key

CVE-2023-35934

yt-dlp File Downloader cookie leak

6.1 MediumFix available

yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external downloaders are affected, except for curl and httpie (version 3.1.0 or later).

At the file download stage, all cookies are passed by yt-dlp to the file downloader as a Cookie header, thereby losing their scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped.

yt-dlp version 2023.07.06 and nightly 2023.07.06.185519 fix this issue by removing the Cookie header upon HTTP redirects; having native downloaders calculate the Cookie header from the cookiejar, utilizing external downloaders' built-in support for cookies instead of passing them as header arguments, disabling HTTP redirectiong if the external downloader does not have proper cookie support, processing cookies passed as HTTP headers to limit their scope, and having a separate field for cookies in the info dict storing more information about scoping

Some workarounds are available for those who are unable to upgrade. Avoid using cookies and user authentication methods. While extractors may set custom cookies, these usually do not contain sensitive information. Alternatively, avoid using --load-info-json. Or, if authentication is a must: verify the integrity of download links from unknown sources in browser (including redirects) before passing them to yt-dlp; use curl as external downloader, since it is not impacted; and/or avoid fragmented formats such as HLS/m3u8, DASH/mpd and ISM.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.05%Up 1.0 points since Jul 7, 2023
90%50%10%1%

What each source reports

CVE List Score used 6.1

yt-dlp File Downloader cookie leak

yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external downloaders are affected, except for curl and httpie (version 3.1.0 or later).

At the file download stage, all cookies are passed by yt-dlp to the file downloader as a Cookie header, thereby losing their scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped.

yt-dlp version 2023.07.06 and nightly 2023.07.06.185519 fix this issue by removing the Cookie header upon HTTP redirects; having native downloaders calculate the Cookie header from the cookiejar, utilizing external downloaders' built-in support for cookies instead of passing them as header arguments, disabling HTTP redirectiong if the external downloader does not have proper cookie support, processing cookies passed as HTTP headers to limit their scope, and having a separate field for cookies in the info dict storing more information about scoping

Some workarounds are available for those who are unable to upgrade. Avoid using cookies and user authentication methods. While extractors may set custom cookies, these usually do not contain sensitive information. Alternatively, avoid using --load-info-json. Or, if authentication is a must: verify the integrity of download links from unknown sources in browser (including redirects) before passing them to yt-dlp; use curl as external downloader, since it is not impacted; and/or avoid fragmented formats such as HLS/m3u8, DASH/mpd and ISM.

Record
CVE-2023-35934
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
EUVDEUVD-2023-2146 6.1

yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external downloaders are affected, except for curl and httpie (version 3.1.0 or later).

At the file download stage, all cookies are passed by yt-dlp to the file downloader as a Cookie header, thereby losing their scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped.

yt-dlp version 2023.07.06 and nightly 2023.07.06.185519 fix this issue by removing the Cookie header upon HTTP redirects; having native downloaders calculate the Cookie header from the cookiejar, utilizing external downloaders' built-in support for cookies instead of passing them as header arguments, disabling HTTP redirectiong if the external downloader does not have proper cookie support, processing cookies passed as HTTP headers to limit their scope, and having a separate field for cookies in the info dict storing more information about scoping

Some workarounds are available for those who are unable to upgrade. Avoid using cookies and user authentication methods. While extractors may set custom cookies, these usually do not contain sensitive information. Alternatively, avoid using --load-info-json. Or, if authentication is a must: verify the integrity of download links from unknown sources in browser (including redirects) before passing them to yt-dlp; use curl as external downloader, since it is not impacted; and/or avoid fragmented formats such as HLS/m3u8, DASH/mpd and ISM.

Record
EUVD-2023-2146
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-v8mc-9377-rwjj 6.1

yt-dlp File Downloader cookie leak

Impact

During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host.

This vulnerable behavior is present in all versions of youtube-dl, youtube-dlc and yt-dlp released since 2015.01.25. All native and external downloaders are affected, except for curl and httpie (httpie version 3.1.0 or later).

At the file download stage, all cookies are passed by yt-dlp to the file downloader as a Cookie header, thereby losing their scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped.

An example of a potential attack scenario exploiting this vulnerability:

  1. an attacker has crafted a malicious website with an embedded URL designed to be detected by yt-dlp as a video download. This embedded URL has the domain of a trusted site that the user has loaded cookies for, and conducts an unvalidated redirect to a target URL.
  2. yt-dlp extracts this URL and calculates a Cookie header based on its domain for the file downloader to make its request(s) with.
  3. the download URL redirects to a server controlled by the attacker, to which yt-dlp forwards the user's sensitive cookie information.

Patches

yt-dlp version 2023.07.06 fixes this issue by doing the following:

  • Remove the Cookie header upon HTTP redirects
  • Have native downloaders calculate their own Cookie header from the cookiejar
  • Utilize external downloaders' built-in support for cookies instead of passing them as header arguments
  • If the external downloader does not have proper cookie support, then disable HTTP redirection (axel only)
  • Process cookies passed as HTTP headers to limit their scope (--add-header "Cookie:..." is scoped to input URL domain only)
  • Store cookies in a separate cookies field of the info dict instead of http_headers so as not to lose their scope

Patches for youtube-dl are expected and we will update this advisory when they are merged.

Workarounds

It is recommended to upgrade yt-dlp to version 2023.07.06 as soon as possible.

For users who are not able to upgrade:

  • Avoid using cookies and user authentication methods (--cookies, --cookies-from-browser, --username, --password, --netrc). While extractors may set custom cookies, these usually do not contain sensitive information.
  • Avoid using --load-info-json

Or, if authentication is a must:

  • Verify the integrity of download links from unknown sources in browser (including redirects) before passing them to yt-dlp
  • Use curl as external downloader, since it is not impacted (--downloader curl)
  • Avoid fragmented formats such as HLS/m3u8, DASH/mpd and ISM (use -f "(bv*+ba/b)[protocol~='^https?$']")

References

Record
GHSA-v8mc-9377-rwjj
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-200, CWE-601
Updated
2026-11-02
NVD 6.1

yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external downloaders are affected, except for curl and httpie (version 3.1.0 or later).

At the file download stage, all cookies are passed by yt-dlp to the file downloader as a Cookie header, thereby losing their scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped.

yt-dlp version 2023.07.06 and nightly 2023.07.06.185519 fix this issue by removing the Cookie header upon HTTP redirects; having native downloaders calculate the Cookie header from the cookiejar, utilizing external downloaders' built-in support for cookies instead of passing them as header arguments, disabling HTTP redirectiong if the external downloader does not have proper cookie support, processing cookies passed as HTTP headers to limit their scope, and having a separate field for cookies in the info dict storing more information about scoping

Some workarounds are available for those who are unable to upgrade. Avoid using cookies and user authentication methods. While extractors may set custom cookies, these usually do not contain sensitive information. Alternatively, avoid using --load-info-json. Or, if authentication is a must: verify the integrity of download links from unknown sources in browser (including redirects) before passing them to yt-dlp; use curl as external downloader, since it is not impacted; and/or avoid fragmented formats such as HLS/m3u8, DASH/mpd and ISM.

Record
CVE-2023-35934
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Weakness
CWE-200, CWE-601
Updated
2026-11-02
OSVALPINE-CVE-2023-35934 8.2

yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external downloaders are affected, except for curl and httpie (version 3.1.0 or later).

At the file download stage, all cookies are passed by yt-dlp to the file downloader as a Cookie header, thereby losing their scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped.

yt-dlp version 2023.07.06 and nightly 2023.07.06.185519 fix this issue by removing the Cookie header upon HTTP redirects; having native downloaders calculate the Cookie header from the cookiejar, utilizing external downloaders' built-in support for cookies instead of passing them as header arguments, disabling HTTP redirectiong if the external downloader does not have proper cookie support, processing cookies passed as HTTP headers to limit their scope, and having a separate field for cookies in the info dict storing more information about scoping

Some workarounds are available for those who are unable to upgrade. Avoid using cookies and user authentication methods. While extractors may set custom cookies, these usually do not contain sensitive information. Alternatively, avoid using --load-info-json. Or, if authentication is a must: verify the integrity of download links from unknown sources in browser (including redirects) before passing them to yt-dlp; use curl as external downloader, since it is not impacted; and/or avoid fragmented formats such as HLS/m3u8, DASH/mpd and ISM.

Record
ALPINE-CVE-2023-35934
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Updated
2026-11-03
OSV 6.1

yt-dlp File Downloader cookie leak

yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external downloaders are affected, except for curl and httpie (version 3.1.0 or later).

At the file download stage, all cookies are passed by yt-dlp to the file downloader as a Cookie header, thereby losing their scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped.

yt-dlp version 2023.07.06 and nightly 2023.07.06.185519 fix this issue by removing the Cookie header upon HTTP redirects; having native downloaders calculate the Cookie header from the cookiejar, utilizing external downloaders' built-in support for cookies instead of passing them as header arguments, disabling HTTP redirectiong if the external downloader does not have proper cookie support, processing cookies passed as HTTP headers to limit their scope, and having a separate field for cookies in the info dict storing more information about scoping

Some workarounds are available for those who are unable to upgrade. Avoid using cookies and user authentication methods. While extractors may set custom cookies, these usually do not contain sensitive information. Alternatively, avoid using --load-info-json. Or, if authentication is a must: verify the integrity of download links from unknown sources in browser (including redirects) before passing them to yt-dlp; use curl as external downloader, since it is not impacted; and/or avoid fragmented formats such as HLS/m3u8, DASH/mpd and ISM.

Record
CVE-2023-35934
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2023-35934 8.2

yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external downloaders are affected, except for curl and httpie (version 3.1.0 or later). At the file download stage, all cookies are passed by yt-dlp to the file downloader as a Cookie header, thereby losing their scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped. yt-dlp version 2023.07.06 and nightly 2023.07.06.185519 fix this issue by removing the Cookie header upon HTTP redirects; having native downloaders calculate the Cookie header from the cookiejar, utilizing external downloaders' built-in support for cookies instead of passing them as header arguments, disabling HTTP redirectiong if the external downloader does not have proper cookie support, processing cookies passed as HTTP headers to limit their scope, and having a separate field for cookies in the info dict storing more information about scoping Some workarounds are available for those who are unable to upgrade. Avoid using cookies and user authentication methods. While extractors may set custom cookies, these usually do not contain sensitive information. Alternatively, avoid using --load-info-json. Or, if authentication is a must: verify the integrity of download links from unknown sources in browser (including redirects) before passing them to yt-dlp; use curl as external downloader, since it is not impacted; and/or avoid fragmented formats such as HLS/m3u8, DASH/mpd and ISM.

Record
DEBIAN-CVE-2023-35934
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Updated
2026-11-02
OSVGHSA-v8mc-9377-rwjj 6.1

yt-dlp File Downloader cookie leak

Impact

During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host.

This vulnerable behavior is present in all versions of youtube-dl, youtube-dlc and yt-dlp released since 2015.01.25. All native and external downloaders are affected, except for curl and httpie (httpie version 3.1.0 or later).

At the file download stage, all cookies are passed by yt-dlp to the file downloader as a Cookie header, thereby losing their scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped.

An example of a potential attack scenario exploiting this vulnerability:

  1. an attacker has crafted a malicious website with an embedded URL designed to be detected by yt-dlp as a video download. This embedded URL has the domain of a trusted site that the user has loaded cookies for, and conducts an unvalidated redirect to a target URL.
  2. yt-dlp extracts this URL and calculates a Cookie header based on its domain for the file downloader to make its request(s) with.
  3. the download URL redirects to a server controlled by the attacker, to which yt-dlp forwards the user's sensitive cookie information.

Patches

yt-dlp version 2023.07.06 fixes this issue by doing the following:

  • Remove the Cookie header upon HTTP redirects
  • Have native downloaders calculate their own Cookie header from the cookiejar
  • Utilize external downloaders' built-in support for cookies instead of passing them as header arguments
  • If the external downloader does not have proper cookie support, then disable HTTP redirection (axel only)
  • Process cookies passed as HTTP headers to limit their scope (--add-header "Cookie:..." is scoped to input URL domain only)
  • Store cookies in a separate cookies field of the info dict instead of http_headers so as not to lose their scope

Patches for youtube-dl are expected and we will update this advisory when they are merged.

Workarounds

It is recommended to upgrade yt-dlp to version 2023.07.06 as soon as possible.

For users who are not able to upgrade:

  • Avoid using cookies and user authentication methods (--cookies, --cookies-from-browser, --username, --password, --netrc). While extractors may set custom cookies, these usually do not contain sensitive information.
  • Avoid using --load-info-json

Or, if authentication is a must:

  • Verify the integrity of download links from unknown sources in browser (including redirects) before passing them to yt-dlp
  • Use curl as external downloader, since it is not impacted (--downloader curl)
  • Avoid fragmented formats such as HLS/m3u8, DASH/mpd and ISM (use -f "(bv*+ba/b)[protocol~='^https?$']")

References

Record
GHSA-v8mc-9377-rwjj
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness
CWE-200, CWE-601
Updated
2026-11-02
OSVPYSEC-2026-2067 6.1

yt-dlp File Downloader cookie leak

Impact

During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host.

This vulnerable behavior is present in all versions of youtube-dl, youtube-dlc and yt-dlp released since 2015.01.25. All native and external downloaders are affected, except for curl and httpie (httpie version 3.1.0 or later).

At the file download stage, all cookies are passed by yt-dlp to the file downloader as a Cookie header, thereby losing their scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped.

An example of a potential attack scenario exploiting this vulnerability:

  1. an attacker has crafted a malicious website with an embedded URL designed to be detected by yt-dlp as a video download. This embedded URL has the domain of a trusted site that the user has loaded cookies for, and conducts an unvalidated redirect to a target URL.
  2. yt-dlp extracts this URL and calculates a Cookie header based on its domain for the file downloader to make its request(s) with.
  3. the download URL redirects to a server controlled by the attacker, to which yt-dlp forwards the user's sensitive cookie information.

Patches

yt-dlp version 2023.07.06 fixes this issue by doing the following:

  • Remove the Cookie header upon HTTP redirects
  • Have native downloaders calculate their own Cookie header from the cookiejar
  • Utilize external downloaders' built-in support for cookies instead of passing them as header arguments
  • If the external downloader does not have proper cookie support, then disable HTTP redirection (axel only)
  • Process cookies passed as HTTP headers to limit their scope (--add-header "Cookie:..." is scoped to input URL domain only)
  • Store cookies in a separate cookies field of the info dict instead of http_headers so as not to lose their scope

Patches for youtube-dl are expected and we will update this advisory when they are merged.

Workarounds

It is recommended to upgrade yt-dlp to version 2023.07.06 as soon as possible.

For users who are not able to upgrade:

  • Avoid using cookies and user authentication methods (--cookies, --cookies-from-browser, --username, --password, --netrc). While extractors may set custom cookies, these usually do not contain sensitive information.
  • Avoid using --load-info-json

Or, if authentication is a must:

  • Verify the integrity of download links from unknown sources in browser (including redirects) before passing them to yt-dlp
  • Use curl as external downloader, since it is not impacted (--downloader curl)
  • Avoid fragmented formats such as HLS/m3u8, DASH/mpd and ISM (use -f "(bv*+ba/b)[protocol~='^https?$']")

References

Record
PYSEC-2026-2067
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2023-35934 6.1

yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external downloaders are affected, except for curl and httpie (version 3.1.0 or later). At the file download stage, all cookies are passed by yt-dlp to the file downloader as a Cookie header, thereby losing their scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped. yt-dlp version 2023.07.06 and nightly 2023.07.06.185519 fix this issue by removing the Cookie header upon HTTP redirects; having native downloaders calculate the Cookie header from the cookiejar, utilizing external downloaders' built-in support for cookies instead of passing them as header arguments, disabling HTTP redirectiong if the external downloader does not have proper cookie support, processing cookies passed as HTTP headers to limit their scope, and having a separate field for cookies in the info dict storing more information about scoping Some workarounds are available for those who are unable to upgrade. Avoid using cookies and user authentication methods. While extractors may set custom cookies, these usually do not contain sensitive information. Alternatively, avoid using --load-info-json. Or, if authentication is a must: verify the integrity of download links from unknown sources in browser (including redirects) before passing them to yt-dlp; use curl as external downloader, since it is not impacted; and/or avoid fragmented formats such as HLS/m3u8, DASH/mpd and ISM.

Record
UBUNTU-CVE-2023-35934
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
CVSS 3.1
8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2023:0374-1 No score

Security update for yt-dlp

This update for yt-dlp fixes the following issues:

  • Update to release 2023.11.14

    • Security: [CVE-2023-46121] Patch Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection
    • Disallow smuggling of arbitrary http_headers; extractors now only use specific headers

  • Make yt-dlp require the one pythonXX-yt-dlp that /usr/bin/yt-dlp was built with.

  • Rework Python build procedure [boo#1216467]

  • Enable Python library [boo#1216467]

  • Update to release 2023.10.13

    • youtube: fix some bug with --extractor-retries inf

  • Update to release 2023.10.07

    • yt: Fix heatmap extraction
    • yt: Raise a warning for Incomplete Data instead of an error

  • Update to release 2023.09.24

    • Extract subtitles from SMIL manifests
    • fb: Add dash manifest URL
    • crunchyroll: Remove initial state extraction
    • youtube: Add player_params extractor arg

  • remove suggests on brotlicffi - this is only for != cpython

  • Update to release 2023.07.06

    • Prevent Cookie leaks on HTTP redirect [boo#1213124] [CVE-2023-35934]
    • yt: Avoid false DRM detection
    • yt: Process post_live over 2 hours
    • yt: Support shorts-only playlists

  • Update to release 2023.06.22

    • youtube: add IOS to default clients used

  • Update to release 2023.06.21

    • Add option --compat-option playlist-match-filter
    • Add options --no-quiet, option --color, --netrc-cmd, --xff
    • Auto-select default format in -f-
    • Improve HTTP redirect handling
    • Support decoding multiple content encodings

  • Use python3.11 on Leap 15.5

    • python3.11 is the only python3 > 3.6 version would be shipped in Leap 15.5

  • Update to release 2023.03.04

    • A bunch of extractor fixes

  • Update to release 2023.03.03

    • youtube: Construct dash formats with range query
    • yt: Detect and break on looping comments
    • yt: Extract channel view_count when /about tab is passed

  • Update to release 2023.02.17

    • Merge youtube-dl: Upto commit/2dd6c6e (Feb 17 2023)
    • Fix --concat-playlist
    • Imply --no-progress when --print
    • Improve default subtitle language selection
    • Make title completely non-fatal
    • Sanitize formats before sorting
    • [hls] Allow extractors to provide AES key
    • [extractor/generic] Avoid catastrophic backtracking in KVS regex
    • [jsinterp] Support if statements
    • [plugins] Fix zip search paths
    • [utils] Don't use Content-length with encoding
    • [utils] Fix time_seconds to use the provided TZ
    • [utils] Fix race condition in make_dir
    • [extractor/anchorfm] Add episode
    • [extractor/boxcast] Add extractor
    • [extractor/ebay] Add extractor
    • [extractor/hypergryph] Add extractor
    • [extractor/NZOnScreen] Add extractor
    • [extractor/rozhlas] Add extractor
    • [extractor/tempo] Add IVXPlayer extractor
    • [extractor/txxx] Add extractors
    • [extractor/vocaroo] Add extractor
    • [extractor/wrestleuniverse] Add extractors
    • [extractor/yappy] Add extractor
    • [extractor/youtube] Fix uploader_id extraction
    • [extractor/youtube] Add hyperpipe instances
    • [extractor/youtube] Handle consent.youtube
    • [extractor/youtube] Support /live/ URL
    • [extractor/youtube] Update invidious and piped instances
    • [extractor/91porn] Fix title and comment extraction
    • [extractor/AbemaTV] Cache user token whenever appropriate
    • [extractor/bfmtv] Support rmc prefix
    • [extractor/biliintl] Add intro and ending chapters
    • [extractor/clyp] Support wav
    • [extractor/crunchyroll] Add intro chapter
    • [extractor/crunchyroll] Better message for premium videos
    • [extractor/crunchyroll] Fix incorrect premium-only error
    • [extractor/DouyuTV] Use new API
    • [extractor/embedly] Embedded links may be for other extractors
    • [extractor/freesound] Workaround invalid URL in webpage
    • [extractor/GoPlay] Use new API
    • [extractor/Hidive] Fix subtitles and age-restriction
    • [extractor/huya] Support HD streams
    • [extractor/moviepilot] Fix extractor
    • [extractor/nbc] Fix NBC and NBCStations extractors
    • [extractor/nbc] Fix XML…
Record
openSUSE-SU-2023:0374-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13142-1 No score

yt-dlp-2023.07.06-1.1 on GA media

These are all security issues fixed in the yt-dlp-2023.07.06-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13142-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
yt-dlp
PyPI
 before 2023.7.06
2023.7.06
yt-dlp
Alpine:v3.18
 before 2023.07.06-r0
2023.07.06-r0
yt-dlp
Alpine:v3.19
 before 2023.07.06-r0
2023.07.06-r0
yt-dlp
Alpine:v3.20
 before 2023.07.06-r0
2023.07.06-r0
yt-dlp
Alpine:v3.21
 before 2023.07.06-r0
2023.07.06-r0
yt-dlp
Alpine:v3.22
 before 2023.07.06-r0
2023.07.06-r0
yt-dlp
Alpine:v3.23
 before 2023.07.06-r0
2023.07.06-r0
yt-dlp
Alpine:v3.24
 before 2023.07.06-r0
2023.07.06-r0
youtube-dl
Debian:12
 All versions, plus listed versions
2021.12.17-2
 None known
yt-dlp
Debian:12
 All versions, plus listed versions
2023.03.04-12023.06.21-12023.06.22-12023.06.22-1~bpo12+12023.07.06-1
Show 45 moreShow less
2023.07.06-1~bpo12+12023.09.24-12023.09.24-22023.09.24-2~bpo12+12023.10.07-12023.10.07-1~bpo12+12023.10.13-12023.10.13-1~bpo11+12023.10.13-1~bpo12+12023.11.16-12023.11.16-1~bpo11+12023.11.16-1~bpo12+12023.12.30-12024.03.10-12024.03.10-1~bpo12+12024.04.09-12024.04.09-1~bpo12+12024.05.26-12024.05.26-1~bpo12+12024.05.27-12024.05.27-1~bpo12+12024.07.01-12024.07.02-12024.07.02-1~bpo12+12024.07.07-12024.07.09-12024.07.09-1~bpo12+12024.07.16-12024.07.16-1~bpo12+12024.07.25-12024.07.25-1~bpo12+12024.08.01-12024.08.01-1~bpo12+12024.08.06-12024.08.06-1~bpo12+12024.09.27-12024.09.27-1~bpo12+12024.10.07-12024.10.07-1~bpo12+12024.10.22-12024.10.22-1~bpo12+12024.11.04-12024.11.18-12024.11.18-1~bpo12+12024.12.03-1
 None known
Show 11 moreShow less
Affected packages
PackageAffectedFixed
yt-dlp
Debian:13
 before 2023.07.06-1
2023.07.06-1
yt-dlp
Debian:14
 before 2023.07.06-1
2023.07.06-1
yt-dlp
PyPI
 before 2023.7.06, plus listed versions
2021.1.152021.1.15.post12021.1.162021.1.202021.1.24
Show 45 moreShow less
2021.1.24.post12021.1.292021.10.102021.10.222021.10.92021.11.102021.11.10.12021.12.12021.12.252021.12.272021.2.152021.2.192021.2.242021.2.42021.2.92021.3.12021.3.152021.3.212021.3.242021.3.24.12021.3.32021.3.3.12021.3.3.22021.3.72021.4.112021.4.222021.4.32021.5.112021.5.202021.6.12021.6.232021.6.82021.6.92021.7.212021.7.242021.7.72021.8.102021.8.22021.9.12021.9.22021.9.252022.1.212022.10.42022.11.112022.2.3
2023.7.06
yt-dlp
Ubuntu:22.04:LTS
 All versions, plus listed versions
2021.12.01-12021.12.27-12022.01.21-12022.02.04-12022.03.08.1-12022.04.08-1
 None known
yt-dlp
Ubuntu:24.04:LTS
 All versions, plus listed versions
2023.07.06-12023.10.13-1ubuntu12023.11.16-12023.12.30-1ubuntu12024.03.10-12024.04.09-1
 None known
yt-dlp
Ubuntu:25.10
 All versions, plus listed versions
2025.03.27-12025.04.30-12025.05.22-12025.06.09-12025.06.25-1
Show 8 moreShow less
2025.06.30-12025.07.21-12025.08.11-12025.08.20-12025.08.22-12025.08.27-12025.09.05-12025.09.23-1
 None known
yt-dlp
Ubuntu:26.10
 All versions, plus listed versions
2026.03.17-12026.06.09-12026.07.04-12026.08.19-1
 None known
yt-dlp
Ubuntu:26.04:LTS
 All versions, plus listed versions
2025.09.23-12025.10.22-12025.11.12-12025.12.08-12026.01.31-12026.03.17-1
 None known
yt-dlp
SUSE:Package Hub 15 SP5
 before 2023.11.14-bp155.3.3.1
2023.11.14-bp155.3.3.1
yt-dlp
openSUSE:Leap 15.5
 before 2023.11.14-bp155.3.3.1
2023.11.14-bp155.3.3.1
yt-dlp
openSUSE:Tumbleweed
 before 2023.07.06-1.1
2023.07.06-1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-35934 is a medium vulnerability (CVSS 6.1) in Yt-dlp, published July 6, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.05%, the 64th percentile. Fixed in yt-dlp 2023.7.06.

References

Show 18 moreShow less
This page doesn't list everything

Left out here: 90 versions and the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open