yt-dlp vulnerabilities

CVEs per yearBy the year they were published

1. 20233
2. 20242
3. 20251
4. 20265

Newest CVEs

• CVE-2026-55404

  yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

  yt-dlp · yt-dlp

  High7.5
• CVE-2026-50019

  yt-dlp: File Downloader cookie leak with curl

  yt-dlp · yt-dlp

  Medium6.1
• CVE-2026-50574

  yt-dlp: Arbitrary code execution via manifest downloads with aria2c

  yt-dlp · yt-dlp

  High8.3
• CVE-2026-50023

  yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)

  yt-dlp · yt-dlp

  High8.3
• CVE-2026-26331

  yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

  yt-dlp · yt-dlp

  High8.8
• CVE-2025-54072

  yt-dlp allows `--exec` command injection when using placeholder on Windows

  yt-dlp · yt-dlp

  High7.5
• CVE-2024-38519

  yt-dlp and youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization

  yt-dlp · yt-dlp

  High7.8
• CVE-2024-22423

  yt-dlp `--exec` command injection when using `%q` in yt-dlp on Windows

  yt-dlp · yt-dlp

  High8.4
• CVE-2023-46121

  Generic Extractor MITM Vulnerability in yt-dlp

  yt-dlp · yt-dlp

  Medium5.0
• CVE-2023-40581

  yt-dlp command injection when using `%q` in `--exec` on Windows

  yt-dlp · yt-dlp

  High8.4