Read the docs
TI-2023-24763 Aliases CVE-2023-46121GHSA-3ch3-jhc6-5r8x

Generic Extractor MITM Vulnerability in yt-dlp

Priority LOW 23CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-613.

Summary

yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP session. This could lead to cookie exfiltration in some cases. Version 2023.11.14 removed the ability to smuggle `http_headers` to the Generic extractor, as well as other extractors that use the same pattern. Users are advised to upgrade. Users unable to upgrade should disable the Ggneric extractor (or only pass trusted sites with trusted content) and ake caution when using `--no-check-certificate`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00321 25th percentileScored 2026-11-07
Fix Fixed yt-dlp (yt-dlp): 2023.11.14yt-dlp (PyPI): 2023.11.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
yt-dlpyt-dlp2022.10.04 to before 2023.11.142023.11.14Patch availableCNA
—yt-dlp (PyPI)2022.10.04 to before 2023.11.142023.11.14Patch availableGHSA-3ch3-jhc6-5r8x
  • yt-dlp Vendoryt-dlp Affected 2022.10.04 to before 2023.11.14 Fixed in 2023.11.14 Patch available CNA
  • yt-dlp (PyPI) Vendor— Affected 2022.10.04 to before 2023.11.14 Fixed in 2023.11.14 Patch available GHSA-3ch3-jhc6-5r8x

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:yt-dlp_project:yt-dlp:*:*:*:*:*:*:*:*2022.10.04 to before 2023.11.14Vulnerableyt-dlp
  • cpe:2.3:a:yt-dlp_project:yt-dlp:*:*:*:*:*:*:*:* Versions 2022.10.04 to before 2023.11.14 Vulnerable ·yt-dlp

Remediation

  • Fix · CNA yt-dlp (yt-dlp) Fixed in 2023.11.14
  • Fix · GHSA-3ch3-jhc6-5r8x yt-dlp (PyPI) Fixed in 2023.11.14 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-46121
  2. 2026-10-03 Alias added: GHSA-3ch3-jhc6-5r8x

References

Patch 1

Advisory 2

Other 2

  • TI-2024-03325 Command injection vulnerability in programing languages on Microsoft Windows operating system. CVSS 3.1CRITICAL 9.8
  • TI-2026-36849 yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519) CVSS 3.1CRITICAL 9.6
  • TI-2025-33915 yt-dlp allows `--exec` command injection when using placeholder on Windows CVSS 3.1HIGH 8.1
  • TI-2024-14996 yt-dlp `--exec` command injection when using `%q` in yt-dlp on Windows CVSS 3.1CRITICAL 9.8
  • TI-2026-21287 yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option CVSS 3.1HIGH 8.8
  • TI-2026-37295 yt-dlp: Arbitrary code execution via manifest downloads with aria2c CVSS 3.1CRITICAL 9.6
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences