Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

yt-dlp vulnerabilities

11 published CVEs name yt-dlp among the affected products.

Newest CVEs

  • CVE-2026-55404

    yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

    yt-dlp · yt-dlp

    High7.5
  • CVE-2026-50019

    yt-dlp: File Downloader cookie leak with curl

    yt-dlp · yt-dlp

    Medium6.1
  • CVE-2026-50574

    yt-dlp: Arbitrary code execution via manifest downloads with aria2c

    yt-dlp · yt-dlp

    High8.3
  • CVE-2026-50023

    yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)

    yt-dlp · yt-dlp

    High8.3
  • CVE-2026-26331

    yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

    yt-dlp · yt-dlp

    High8.8
  • CVE-2025-54072

    yt-dlp allows `--exec` command injection when using placeholder on Windows

    yt-dlp · yt-dlp

    High7.5
  • CVE-2024-38519

    yt-dlp and youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization

    yt-dlp · yt-dlp

    High7.8
  • CVE-2024-22423

    yt-dlp `--exec` command injection when using `%q` in yt-dlp on Windows

    yt-dlp · yt-dlp

    High8.4
  • CVE-2023-46121

    Generic Extractor MITM Vulnerability in yt-dlp

    yt-dlp · yt-dlp

    Medium5.0
  • CVE-2023-40581

    yt-dlp command injection when using `%q` in `--exec` on Windows

    yt-dlp · yt-dlp

    High8.4