CVE-2026-50574
High · 8.3CVSS
8.3
EPSS
0.5%
Published
Jun 23, 2026
CISA due date
—
The record
yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp. This vulnerability is fixed in 2026.06.09.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | yt-dlp | 0 | 2026.06.09-bp160.1.1 |
| openSUSE:Tumbleweed | yt-dlp | 0 | 2026.06.09-1.1 |
Related vulnerabilities
- CVE-2026-50023 yt-dlp is a command-line audio/video downloader. Also affects yt-dlp
- CVE-2026-50019 yt-dlp is a command-line audio/video downloader. Also affects yt-dlp
- CVE-2024-38519 `yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Also affects yt-dlp
- CVE-2026-114577 A vulnerability was found in oretnom23 php-travel-agency-system. CWE-74
- CVE-2026-114575 A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. CWE-74
- CVE-2026-112150 A security flaw has been discovered in vraj404 Criminal-Management-System up to… CWE-74
- CVE-2026-112141 A vulnerability was determined in satya-vinay Events-Management-System up to… CWE-74
- CVE-2026-112100 A vulnerability was determined in DeepPavlov up to 1.7.0. CWE-74