Skip to contentYt-dlp Project Yt-dlp vulnerabilities
- yt-dlpyt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link outputCVE-2026-55404Fix available7.5 High
- yt-dlpyt-dlp: Arbitrary code execution via manifest downloads with aria2cCVE-2026-50574Fix available8.3 High
- yt-dlpyt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)CVE-2026-50023Fix available8.3 High
- yt-dlpyt-dlp: File Downloader cookie leak with curlCVE-2026-50019Fix available6.1 Medium
- yt-dlpyt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` optionCVE-2026-26331Public exploitFix available8.8 High
- yt-dlpyt-dlp allows `--exec` command injection when using placeholder on WindowsCVE-2025-54072Fix available7.5 High
- yt-dlp, ytdl-org youtube-dl +1 moreyt-dlp and youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitizationCVE-2024-38519Fix available7.8 High
- go programming language golang, haskell process library, haskell programming language haskel +6 more +8 moreCommand injection vulnerability in programing languages on Microsoft Windows operating system.CVE-2024-3566Fix available9.8 Critical
- yt-dlpyt-dlp `--exec` command injection when using `%q` in yt-dlp on WindowsCVE-2024-22423Fix available8.4 High
- yt-dlpGeneric Extractor MITM Vulnerability in yt-dlpCVE-2023-46121Fix available5.0 Medium
- yt-dlpyt-dlp command injection when using `%q` in `--exec` on WindowsCVE-2023-40581Fix available8.4 High
- yt-dlp, fedoraproject fedora, youtube-dlc project youtube-dlc +1 more +3 moreyt-dlp File Downloader cookie leakCVE-2023-35934Fix available6.1 Medium