Yt-dlp

This hub aggregates every CVE we track for Yt-dlp, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 11 most recently published vulnerabilities affecting Yt-dlp.

• CVE-2026-50019yt-dlp: File Downloader cookie leak with curl6.1Jun 23, 2026
• CVE-2026-50574yt-dlp: Arbitrary code execution via manifest downloads with aria2c8.3Jun 23, 2026
• CVE-2026-50023yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)8.3Jun 23, 2026
• CVE-2026-26331yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option8.8Feb 24, 2026
• CVE-2025-54072yt-dlp allows `--exec` command injection when using placeholder on Windows7.5Jul 22, 2025
• CVE-2024-38519yt-dlp and youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization7.8Jul 2, 2024
• CVE-2024-3566Command injection vulnerability in programing languages on Microsoft Windows operating system.9.8Apr 10, 2024
• CVE-2024-22423yt-dlp `--exec` command injection when using `%q` in yt-dlp on Windows8.3Apr 9, 2024
• CVE-2023-46121Generic Extractor MITM Vulnerability in yt-dlp5.0Nov 14, 2023
• CVE-2023-40581yt-dlp command injection when using `%q` in `--exec` on Windows8.3Sep 25, 2023
• CVE-2023-35934yt-dlp File Downloader cookie leak6.1Jul 6, 2023