yt-dlp vulnerabilities
11 published CVEs name yt-dlp among the affected products.
- 11Published CVEs11 of them scored
- 5Last 12 monthspublished in the last year
- 0Critical8 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-55404
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
yt-dlp · yt-dlp
High7.5 - CVE-2026-50019
yt-dlp: File Downloader cookie leak with curl
yt-dlp · yt-dlp
Medium6.1 - CVE-2026-50574
yt-dlp: Arbitrary code execution via manifest downloads with aria2c
yt-dlp · yt-dlp
High8.3 - CVE-2026-50023
yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
yt-dlp · yt-dlp
High8.3 - CVE-2026-26331
yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
yt-dlp · yt-dlp
High8.8 - CVE-2025-54072
yt-dlp allows `--exec` command injection when using placeholder on Windows
yt-dlp · yt-dlp
High7.5 - CVE-2024-38519
yt-dlp and youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization
yt-dlp · yt-dlp
High7.8 - CVE-2024-22423
yt-dlp `--exec` command injection when using `%q` in yt-dlp on Windows
yt-dlp · yt-dlp
High8.4 - CVE-2023-46121
Generic Extractor MITM Vulnerability in yt-dlp
yt-dlp · yt-dlp
Medium5.0 - CVE-2023-40581
yt-dlp command injection when using `%q` in `--exec` on Windows
yt-dlp · yt-dlp
High8.4