Back to overview

CVE-2026-50574

HIGH
8.3
CVSS 3.1
Description
yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp. This vulnerability is fixed in 2026.06.09.

Metadata

CVE ID
CVE-2026-50574
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-06-04 21:34 UTC
Published
2026-06-23 16:09 UTC
Last updated
2026-06-23 17:03 UTC
Primary CWE
CWE-74
CWE-74: Improper Neutralization of Special Elements in Outpu…
Vendor / Product
yt-dlp / yt-dlp
Sources
cve.org  ·  NVD

Severity & Metrics

8.3 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
yt-dlp yt-dlp — < 2026.06.09
Weakness (CWE)
CWESourceDescription
CWE-74 cna CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
8.3 HIGH 3.1 cna CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
References (1)
Back to overview