VulnSea

yt-dlp vulnerabilities

CVEs whose affected-version data names the yt-dlp package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

11 CVEsRSS

CVE-2026-55404High· 7.5
3mo ago

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

▾ Twilightyt-dlp · yt-dlpEPSS 0.64%via GHSA
CVE-2026-50019Medium· 6.1
4mo ago

yt-dlp: File Downloader cookie leak with curl

yt-dlp: File Downloader cookie leak with curl

▾ Sunlityt-dlp · yt-dlpEPSS 0.32%via GHSA
CVE-2026-50023High· 8.3
4mo ago

yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)

yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)

▾ Twilightyt-dlp · yt-dlpEPSS 0.66%via GHSA
CVE-2026-50574High· 8.3
4mo ago

yt-dlp: Arbitrary code execution via manifest downloads with aria2c

yt-dlp: Arbitrary code execution via manifest downloads with aria2c

▾ Twilightyt-dlp · yt-dlpEPSS 0.46%via GHSA
GHSA-69qj-pvh9-c5wgHigh· 7.5
4mo ago

yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp

yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp

▾ Twilightyt-dlp · yt-dlpvia GHSA
CVE-2026-26331High· 8.8PoC
8mo ago

yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

▾ Midnightyt-dlp · yt-dlpEPSS 1.8%via OSV
CVE-2024-38519High· 7.8
2y ago

yt-dlp File system modification and RCE through improper file-extension sanitization

yt-dlp File system modification and RCE through improper file-extension sanitization

▾ Twilightyt-dlp · yt-dlpEPSS 0.33%via OSV
CVE-2024-22423High· 8.3
2y ago

yt-dlp: `--exec` command injection when using `%q` in yt-dlp on Windows (Bypass of CVE-2023-40581)

yt-dlp: `--exec` command injection when using `%q` in yt-dlp on Windows (Bypass of CVE-2023-40581)

▾ Twilightyt-dlp · yt-dlpEPSS 1.4%via OSV
CVE-2023-46121Medium· 5.0
2y ago

yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection

yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection

▾ Sunlityt-dlp · yt-dlpEPSS 0.32%via OSV
CVE-2023-40581High· 8.3
3y ago

yt-dlp on Windows vulnerable to `--exec` command injection when using `%q`

yt-dlp on Windows vulnerable to `--exec` command injection when using `%q`

▾ Twilightyt-dlp · yt-dlpEPSS 1.3%via OSV
CVE-2023-35934Medium· 6.1
3y ago

yt-dlp File Downloader cookie leak

yt-dlp File Downloader cookie leak

▾ Sunlityt-dlp · yt-dlpEPSS 1.0%via OSV
yt-dlp vulnerabilities (CVEs) · VulnSea