Vulnerabilities

TI-2026-39974 CVE-2026-55404 · GHSA-6v4j-43gg-vj32

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

MEDIUM 41

yt-dlp and youtube-dl are command-line audio/video downloaders.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0064 Published 2026-07-08 Fixed in 2026.7.4 CWE-74

TI-2026-36845 CVE-2026-50019 · GHSA-f7j3-774f-rfhj

yt-dlp: File Downloader cookie leak with curl

LOW 32

yt-dlp is a command-line audio/video downloader.

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.00319 Published 2026-06-23 Fixed in 2026.06.09, 2026.6.9 CWE-200

TI-2026-37295 CVE-2026-50574 · GHSA-vx4q-3cr2-7cg2

yt-dlp: Arbitrary code execution via manifest downloads with aria2c

MEDIUM 43

yt-dlp is a command-line audio/video downloader.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00465 Published 2026-06-23 Fixed in 2026.06.09, 2026.6.9 CWE-74

TI-2026-36849 CVE-2026-50023 · GHSA-c6mh-fpjc-4pr3

yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)

HIGH 76

yt-dlp is a command-line audio/video downloader.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00665 Published 2026-06-23 Fixed in 2026.06.09, 2026.6.9 CWE-641

TI-2026-21287 CVE-2026-26331 · GHSA-g3gw-q23r-pgqm

yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

MEDIUM 44

yt-dlp is a command-line audio/video downloader.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0182 Published 2026-02-24 Fixed in 2026.02.21 CWE-78

TI-2025-33915 CVE-2025-54072

yt-dlp allows `--exec` command injection when using placeholder on Windows

HIGH 70

yt-dlp is a feature-rich command-line audio/video downloader.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.0065 Published 2025-07-22 Fixed in 2025.07.21 CWE-78

TI-2024-03325 CVE-2024-3566 · GHSA-9xch-xvj3-fmf3

Command injection vulnerability in programing languages on Microsoft Windows operating system.

HIGH 82

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06827 Published 2024-04-10 No fix listed CWE-77

TI-2024-14996 CVE-2024-22423 · GHSA-hjq6-52gw-2g7p

yt-dlp `--exec` command injection when using `%q` in yt-dlp on Windows

MEDIUM 45

yt-dlp is a youtube-dl fork with additional features and fixes.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0143 Published 2024-04-09 Fixed in 2024.04.09 CWE-78

TI-2023-24763 CVE-2023-46121 · GHSA-3ch3-jhc6-5r8x

Generic Extractor MITM Vulnerability in yt-dlp

LOW 23

yt-dlp is a youtube-dl fork with additional features and fixes.

CVSS 3.1MEDIUM 5.0 Network No auth User interaction EPSS 0.00321 Published 2023-11-14 Fixed in 2023.11.14 CWE-444

TI-2023-21379 CVE-2023-40581 · GHSA-42h4-v29r-42qg

yt-dlp command injection when using `%q` in `--exec` on Windows

MEDIUM 41

yt-dlp is a youtube-dl fork with additional features and fixes.

CVSS 3.1HIGH 8.4 Network No auth User interaction EPSS 0.0134 Published 2023-09-25 Fixed in 2023.09.24 CWE-78

TI-2023-17996 CVE-2023-35934 · GHSA-v8mc-9377-rwjj

yt-dlp File Downloader cookie leak

LOW 38

yt-dlp is a command-line program to download videos from video sites.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.01047 Published 2023-07-06 Fixed in 2023.7.06 CWE-200

Vulnerabilities

Filters