GHSA-g3gw-q23r-pgqm
High · 8.8CVSS
8.8
EPSS
—
Published
Feb 23, 2026
CISA due date
—
The record
yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | yt-dlp | 2023.06.21 | 2026.02.21 |
Related vulnerabilities
- CVE-2026-26331 yt-dlp is a command-line audio/video downloader. Same vulnerability
- CVE-2024-38519 `yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Also affects yt-dlp
- CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78
- CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113726 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113722 virtualenv is a tool for creating isolated virtual python environments. CWE-78