Yt-dlp (Yt-dlp Project) - vulnerabilities (CVEs)
12 CVEs, 0 in the last 30 days, 104 known versions, newest CVE from 2026-07-08. Vendor: Yt-dlp Project.
CVEs of Yt-dlp
- CVE-2026-55404 - CVSS 8.8 (high), 2026-07-08: yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can…
- CVE-2026-50023 - CVSS 9.6 (critical), 2026-06-23: yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary…
- CVE-2026-50574 - CVSS 9.6 (critical), 2026-06-23: yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an external downloader for a fragmented manifest format (such as an…
- CVE-2026-50019 - CVSS 7.4 (high), 2026-06-23: yt-dlp is a command-line audio/video downloader. From 2023.09.24 until 2026.06.09, if curl is used as an external downloader for yt-dlp, cookies may be leaked…
- CVE-2026-26331 - CVSS 8.8 (high), 2026-02-24: yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's `--netrc-cmd` command-line…
- CVE-2025-54072 - CVSS 8.1 (high), 2025-07-22: yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default…
- CVE-2024-38519 - CVSS 7.8 (high), 2024-07-02: `yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of…
- CVE-2024-3566 - CVSS 9.8 (critical), 2024-04-10: A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function…
- CVE-2024-22423 - CVSS 9.8 (critical), 2024-04-09: yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using `--exec` with `%q`…
- CVE-2023-46121 - CVSS 5 (medium), 2023-11-15: yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a…
- CVE-2023-40581 - CVSS 8.4 (high), 2023-09-25: yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its…
- CVE-2023-35934 - CVSS 8.2 (high), 2023-07-06: yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak…
