PyPIPackage

yt-dlp

10 known vulnerabilities (7 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release: 2026.10.26 (Oct 26, 2026): no advisory affects it
Newest unaffected release: 2026.10.26 (Oct 26, 2026), the latest release
Advisories: 10 · 7 high, 3 medium

Weekly downloads: 5.6M
Dependents: 10
Releases: 500+ since 2024.4.9 (Apr 9, 2024)
Registry: PyPI
Releases read: Nov 8, 2026

Version timeline

CVE-2026-55404
Affects 2024.3.19.232701.dev0 to 2026.7.3.234421.dev0 (2026.7.4 is outside it)
CVE-2026-50019
Affects 2024.3.19.232701.dev0 to 2026.6.6.234447.dev0 (2026.6.9 is outside it)
CVE-2026-50574
Affects 2024.3.19.232701.dev0 to 2026.6.6.234447.dev0 (2026.6.9 is outside it)
CVE-2026-50023
Affects 2024.3.19.232701.dev0 to 2026.6.6.234447.dev0 (2026.6.9 is outside it)
CVE-2026-26331
Affects 2024.3.19.232701.dev0 to 2026.2.20.235452.dev0 (2026.2.21 is outside it)
CVE-2024-38519
Affects 2024.3.19.232701.dev0 to 2024.6.30.232744.dev0 (2024.7.1 is outside it)
CVE-2024-22423
Affects 2024.3.19.232701.dev0 to 2024.4.8.232708.dev0 (2024.4.9 is outside it)
CVE-2023-46121
No published release is affected
No published release is affected
CVE-2023-40581
No published release is affected
No published release is affected
CVE-2023-35934
No published release is affected
No published release is affected

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 10

CVE-2026-55404High 7.5
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
Affected: fixed in 2026.7.4.
Fixed in 2026.7.4 (released Jul 4, 2026, 4 days before disclosure).
The latest release, 2026.10.26, is not affected.
CVE-2026-50019Medium 6.1
yt-dlp: File Downloader cookie leak with curl
Affected: from 2023.9.24, fixed in 2026.6.9.
Fixed in 2026.6.9 (released Jun 9, 2026, 14 days before disclosure).
The latest release, 2026.10.26, is not affected.
CVE-2026-50574High 8.3
yt-dlp: Arbitrary code execution via manifest downloads with aria2c
Affected: fixed in 2026.6.9.
Fixed in 2026.6.9 (released Jun 9, 2026, 14 days before disclosure).
The latest release, 2026.10.26, is not affected.
CVE-2026-50023High 8.3
yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
Affected: fixed in 2026.6.9.
Fixed in 2026.6.9 (released Jun 9, 2026, 14 days before disclosure).
The latest release, 2026.10.26, is not affected.
CVE-2026-26331High 8.8
yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
Affected: from 2023.06.21, fixed in 2026.02.21.
Fixed in 2026.2.21 (released Feb 21, 2026, 3 days before disclosure).
The latest release, 2026.10.26, is not affected.
CVE-2024-38519High 7.8
yt-dlp and youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization
Affected: fixed in 2024.07.01.
Fixed in 2024.7.1 (released Jul 1, 2024, 1 day before disclosure).
The latest release, 2026.10.26, is not affected.
CVE-2024-22423High 8.4
yt-dlp `--exec` command injection when using `%q` in yt-dlp on Windows
Affected: from 2021.04.11, fixed in 2024.04.09.
Fixed in 2024.4.9 (released Apr 9, 2024, the day of disclosure).
The latest release, 2026.10.26, is not affected.
CVE-2023-46121Medium 5.0
Generic Extractor MITM Vulnerability in yt-dlp
Affected: from 2022.10.04, fixed in 2023.11.14.
Fixed in 2023.11.14.
The latest release, 2026.10.26, is not affected.
CVE-2023-40581High 8.4
yt-dlp command injection when using `%q` in `--exec` on Windows
Affected: from 2021.04.11, fixed in 2023.09.24.
Fixed in 2023.09.24.
The latest release, 2026.10.26, is not affected.
CVE-2023-35934Medium 6.1
yt-dlp File Downloader cookie leak
Affected: fixed in 2023.7.06.
Fixed in 2023.7.06.
The latest release, 2026.10.26, is not affected.