Yt-dlp vulnerabilities
We track 10 vulnerabilities in Yt-dlp products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on July 8, 2026.
Latest Yt-dlp vulnerabilities
- 8.8 High severity
yt-dlp: Improper Neutralization of Special Elements in Output Used by a Downstream Component
yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without
- 9.6 Critical severity
yt-dlp: Improper Neutralization of Special Elements in Output Used by a Downstream Component
yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to p
- 9.6 Critical severity
yt-dlp: Improper Restriction of Names for Files and Other Resources
yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for
- 7.4 High severity
yt-dlp: Exposure of Sensitive Information to an Unauthorized Actor
yt-dlp is a command-line audio/video downloader. From 2023.09.24 until 2026.06.09, if curl is used as an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their p
- 8.8 High severity
yt-dlp: Improper Neutralization of Special Elements used in an OS Command
yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter) is used, an attacker could achieve arbitrary command injectio
- 8.1 High severity
yt-dlp: Improper Neutralization of Special Elements used in an OS Command
yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder (or {}), insufficient sanitization is applied to the expanded filepath, allowing for remote c
- 7.8 High severity
yt-dlp: Incorrect Resource Transfer Between Spheres
`yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path t
- 9.8 Critical severity
yt-dlp: Improper Neutralization of Special Elements used in an OS Command
yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using `--exec` with `%q` by replacing double quotes with two double quotes. However, this escaping is not sufficient, and stil
- 7.8 High severity
yt-dlp: Improper Neutralization of Special Elements used in an OS Command
yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the `--exec` flag. This flag allows output template expansion in its argument,
- 8.2 High severity
yt-dlp: URL Redirection to Untrusted Site
yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differ