Vulnerabilities for yt-dlp

First version without a known vulnerability: 2026.7.4.221833.dev0

Details

• GHSA-6v4j-43gg-vj322026-07-24

  yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

  Fixed in: 2026.7.4

• GHSA-69qj-pvh9-c5wg2026-06-16

  yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp

  Fixed in: 2026.6.9

• GHSA-vx4q-3cr2-7cg22026-06-16

  yt-dlp: Arbitrary code execution via manifest downloads with aria2c

  Fixed in: 2026.6.9

• GHSA-c6mh-fpjc-4pr32026-06-16

  yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)

  Fixed in: 2026.6.9

• GHSA-f7j3-774f-rfhj2026-06-16

  yt-dlp: File Downloader cookie leak with curl

  Fixed in: 2026.6.9

• GHSA-g3gw-q23r-pgqm2026-02-23

  yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

  Fixed in: 2026.02.21

• GHSA-3v33-3wmw-37852024-07-08

  yt-dlp has dependency on potentially malicious third-party code in Douyu extractors

  Fixed in: 2024.07.07

• GHSA-79w7-vh3h-8g4j2024-07-02

  yt-dlp File system modification and RCE through improper file-extension sanitization

  Fixed in: 2024.07.01

• GHSA-hjq6-52gw-2g7p2024-04-10

  yt-dlp: `--exec` command injection when using `%q` in yt-dlp on Windows (Bypass of CVE-2023-40581)

  Fixed in: 2024.04.09

• GHSA-3ch3-jhc6-5r8x2023-11-15

  yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection

  Fixed in: 2023.11.14

• GHSA-42h4-v29r-42qg2023-09-25

  yt-dlp on Windows vulnerable to `--exec` command injection when using `%q`

  Fixed in: 2023.09.24

• GHSA-v8mc-9377-rwjj2023-07-06

  yt-dlp File Downloader cookie leak

  Fixed in: 2023.7.06