# yt-dlp (PyPI) vulnerabilities 10 known vulnerabilities (7 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2026.10.26 (Oct 26, 2026): no advisory affects it - Newest unaffected release: 2026.10.26 (Oct 26, 2026), the latest release - Weekly downloads: 5.6M - Dependents: 10 - Releases: 500+ since 2024.4.9 (Apr 9, 2024) - Registry: https://pypi.org/project/yt-dlp/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-55404: 2024.3.19.232701.dev0 to 2026.7.3.234421.dev0 (2026.7.4 is outside it) - CVE-2026-50019: 2024.3.19.232701.dev0 to 2026.6.6.234447.dev0 (2026.6.9 is outside it) - CVE-2026-50574: 2024.3.19.232701.dev0 to 2026.6.6.234447.dev0 (2026.6.9 is outside it) - CVE-2026-50023: 2024.3.19.232701.dev0 to 2026.6.6.234447.dev0 (2026.6.9 is outside it) - CVE-2026-26331: 2024.3.19.232701.dev0 to 2026.2.20.235452.dev0 (2026.2.21 is outside it) - CVE-2024-38519: 2024.3.19.232701.dev0 to 2024.6.30.232744.dev0 (2024.7.1 is outside it) - CVE-2024-22423: 2024.3.19.232701.dev0 to 2024.4.8.232708.dev0 (2024.4.9 is outside it) - CVE-2023-46121: no published release is affected - CVE-2023-40581: no published release is affected - CVE-2023-35934: no published release is affected Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (10) ### [CVE-2026-55404](https://cve.now/CVE-2026-55404): yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output - Severity: High 7.5 - Published: Jul 8, 2026 - Affected: fixed in 2026.7.4. - Fixed in 2026.7.4 (released Jul 4, 2026, 4 days before disclosure). - The latest release, 2026.10.26, is not affected. ### [CVE-2026-50019](https://cve.now/CVE-2026-50019): yt-dlp: File Downloader cookie leak with curl - Severity: Medium 6.1 - Published: Jun 23, 2026 - Affected: from 2023.9.24, fixed in 2026.6.9. - Fixed in 2026.6.9 (released Jun 9, 2026, 14 days before disclosure). - The latest release, 2026.10.26, is not affected. ### [CVE-2026-50574](https://cve.now/CVE-2026-50574): yt-dlp: Arbitrary code execution via manifest downloads with aria2c - Severity: High 8.3 - Published: Jun 23, 2026 - Affected: fixed in 2026.6.9. - Fixed in 2026.6.9 (released Jun 9, 2026, 14 days before disclosure). - The latest release, 2026.10.26, is not affected. ### [CVE-2026-50023](https://cve.now/CVE-2026-50023): yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519) - Severity: High 8.3 - Published: Jun 23, 2026 - Affected: fixed in 2026.6.9. - Fixed in 2026.6.9 (released Jun 9, 2026, 14 days before disclosure). - The latest release, 2026.10.26, is not affected. ### [CVE-2026-26331](https://cve.now/CVE-2026-26331): yt-dlp: Arbitrary Command Injection when using the \`--netrc-cmd\` option - Severity: High 8.8 - Published: Feb 24, 2026 - Affected: from 2023.06.21, fixed in 2026.02.21. - Fixed in 2026.2.21 (released Feb 21, 2026, 3 days before disclosure). - The latest release, 2026.10.26, is not affected. ### [CVE-2024-38519](https://cve.now/CVE-2024-38519): yt-dlp and youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization - Severity: High 7.8 - Published: Jul 2, 2024 - Affected: fixed in 2024.07.01. - Fixed in 2024.7.1 (released Jul 1, 2024, 1 day before disclosure). - The latest release, 2026.10.26, is not affected. ### [CVE-2024-22423](https://cve.now/CVE-2024-22423): yt-dlp \`--exec\` command injection when using \`%q\` in yt-dlp on Windows - Severity: High 8.4 - Published: Apr 9, 2024 - Affected: from 2021.04.11, fixed in 2024.04.09. - Fixed in 2024.4.9 (released Apr 9, 2024, the day of disclosure). - The latest release, 2026.10.26, is not affected. ### [CVE-2023-46121](https://cve.now/CVE-2023-46121): Generic Extractor MITM Vulnerability in yt-dlp - Severity: Medium 5.0 - Published: Nov 14, 2023 - Affected: from 2022.10.04, fixed in 2023.11.14. - Fixed in 2023.11.14. - The latest release, 2026.10.26, is not affected. ### [CVE-2023-40581](https://cve.now/CVE-2023-40581): yt-dlp command injection when using \`%q\` in \`--exec\` on Windows - Severity: High 8.4 - Published: Sep 25, 2023 - Affected: from 2021.04.11, fixed in 2023.09.24. - Fixed in 2023.09.24. - The latest release, 2026.10.26, is not affected. ### [CVE-2023-35934](https://cve.now/CVE-2023-35934): yt-dlp File Downloader cookie leak - Severity: Medium 6.1 - Published: Jul 6, 2023 - Affected: fixed in 2023.7.06. - Fixed in 2023.7.06. - The latest release, 2026.10.26, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/yt-dlp Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.