yt-dlp has 11 CVEs on record between 2023 and 2026. The busiest recent month was June 2026 with 4. The median CVSS is 7.8 (high). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- —
- Last 90 days
- 0 prev 5
Worst active — by depth score
CVE-2026-26331High· 8.8yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option61CVE-2026-50574High· 8.3yt-dlp: Arbitrary code execution via manifest downloads with aria2c46CVE-2026-50023High· 8.3yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)46CVE-2024-22423High· 8.3yt-dlp: `--exec` command injection when using `%q` in yt-dlp on Windows (Bypass of CVE-2023-40581)46CVE-2023-40581High· 8.3 yt-dlp on Windows vulnerable to `--exec` command injection when using `%q`46
yt-dlp vulnerabilities
CVEs affecting yt-dlp, newest first. Open any entry for full detail, references, and exploit status.
11 CVEsRSS
CVE-2026-55404High· 7.5yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
CVE-2026-50019Medium· 6.1yt-dlp: File Downloader cookie leak with curl
yt-dlp: File Downloader cookie leak with curl
CVE-2026-50023High· 8.3yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
CVE-2026-50574High· 8.3yt-dlp: Arbitrary code execution via manifest downloads with aria2c
yt-dlp: Arbitrary code execution via manifest downloads with aria2c
GHSA-69qj-pvh9-c5wgHigh· 7.5yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp
yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp
CVE-2026-26331High· 8.8PoCyt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
CVE-2024-38519High· 7.8yt-dlp File system modification and RCE through improper file-extension sanitization
yt-dlp File system modification and RCE through improper file-extension sanitization
CVE-2024-22423High· 8.3yt-dlp: `--exec` command injection when using `%q` in yt-dlp on Windows (Bypass of CVE-2023-40581)
yt-dlp: `--exec` command injection when using `%q` in yt-dlp on Windows (Bypass of CVE-2023-40581)
CVE-2023-46121Medium· 5.0yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection
yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection
CVE-2023-40581High· 8.3yt-dlp on Windows vulnerable to `--exec` command injection when using `%q`
yt-dlp on Windows vulnerable to `--exec` command injection when using `%q`
CVE-2023-35934Medium· 6.1yt-dlp File Downloader cookie leak
yt-dlp File Downloader cookie leak