Yt-dlp Project vulnerabilities

Products

• Yt-dlp 12

Newest

• yt-dlp yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output CVE-2026-55404 Fix available 7.5 HighJuly 6, 2026
• yt-dlp yt-dlp: Arbitrary code execution via manifest downloads with aria2c CVE-2026-50574 Fix available 8.3 HighJune 12, 2026
• yt-dlp yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519) CVE-2026-50023 Fix available 8.3 HighJune 12, 2026
• yt-dlp yt-dlp: File Downloader cookie leak with curl CVE-2026-50019 Fix available 6.1 MediumJune 12, 2026
• yt-dlp yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option CVE-2026-26331 Public exploitFix available 8.8 HighFebruary 23, 2026
• yt-dlp yt-dlp allows `--exec` command injection when using placeholder on Windows CVE-2025-54072 Fix available 7.5 HighJuly 22, 2025
• yt-dlp, ytdl-org youtube-dl +1 more yt-dlp and youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization CVE-2024-38519 Fix available 7.8 HighJuly 2, 2024
• go programming language golang, haskell process library, haskell programming language haskel +6 more +8 more Command injection vulnerability in programing languages on Microsoft Windows operating system. CVE-2024-3566 Fix available 9.8 CriticalApril 10, 2024
• yt-dlp yt-dlp `--exec` command injection when using `%q` in yt-dlp on Windows CVE-2024-22423 Fix available 8.4 HighApril 9, 2024
• yt-dlp Generic Extractor MITM Vulnerability in yt-dlp CVE-2023-46121 Fix available 5.0 MediumNovember 14, 2023
• yt-dlp yt-dlp command injection when using `%q` in `--exec` on Windows CVE-2023-40581 Fix available 8.4 HighSeptember 25, 2023
• yt-dlp, fedoraproject fedora, youtube-dlc project youtube-dlc +1 more +3 more yt-dlp File Downloader cookie leak CVE-2023-35934 Fix available 6.1 MediumJuly 6, 2023