yt-dlp vulnerabilities

12 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Latest yt-dlp vulnerabilities

CVE-2026-55404 — yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output (CVSS 8.8)
CVE-2026-50574 — yt-dlp: Arbitrary code execution via manifest downloads with aria2c (CVSS 9.6)
CVE-2026-50023 — yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519) (CVSS 9.6)
CVE-2026-50019 — yt-dlp: File Downloader cookie leak with curl (CVSS 7.4)
CVE-2026-26331 — yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option (CVSS 8.8)
CVE-2025-54072 — yt-dlp allows `--exec` command injection when using placeholder on Windows (CVSS 8.1)
CVE-2024-38519 — yt-dlp and youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization (CVSS 7.8)
CVE-2024-3566 — Command injection vulnerability in programing languages on Microsoft Windows operating system. (CVSS 9.8)
CVE-2024-22423 — yt-dlp `--exec` command injection when using `%q` in yt-dlp on Windows (CVSS 9.8)
CVE-2023-46121 — Generic Extractor MITM Vulnerability in yt-dlp (CVSS 3.7)
CVE-2023-40581 — yt-dlp command injection when using `%q` in `--exec` on Windows (CVSS 7.8)
CVE-2023-35934 — yt-dlp File Downloader cookie leak (CVSS 8.2)