Catálogo de CVE

CVE-2026-50574

yt-dlp is a command-line audio/video downloader. Prior…

[Catálogo de CVE]

yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp. This vulnerability is fixed in 2026.06.09.

Gravidade
Critical · CVSS 9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.46% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiansidyt-dlp2026.06.09-1FixedDistribution-reported fixed boundary[CVE-2026-50574]
Debiansidyt-dlp2026.10.26-1Fixed[CVE-2026-50574]
Debianforkyyt-dlp2026.06.09-1FixedDistribution-reported fixed boundary[CVE-2026-50574]
Debianforkyyt-dlp2026.10.21-1Fixed[CVE-2026-50574]

Showing 4 fix observations. All 11 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedyt-dlpNot reportedUnknownSource applicability is not establishedProvider not reported
UnknownRelease not reportedyt-dlp2026.06.09UnknownSource applicability is not establishedProvider not reported
PyPIRelease not reportedyt-dlp2026.6.9UnknownSource applicability is not establishedProvider not reported
Debianbookwormyt-dlpNot reportedAffectedDistribution reports no fix[CVE-2026-50574]
Debianbookwormyt-dlp2023.03.04-1Affected[CVE-2026-50574]
Debianforkyyt-dlp2026.06.09-1FixedDistribution-reported fixed boundary[CVE-2026-50574]
Debianforkyyt-dlp2026.10.21-1Fixed[CVE-2026-50574]
Debiansidyt-dlp2026.06.09-1FixedDistribution-reported fixed boundary[CVE-2026-50574]
Debiansidyt-dlp2026.10.26-1Fixed[CVE-2026-50574]
Debiantrixieyt-dlpNot reportedAffectedDistribution reports no fix[CVE-2026-50574]
Debiantrixieyt-dlp2025.04.30-1Affected[CVE-2026-50574]
Original provider fields
{
  "package_releases": [
    {
      "name": "yt-dlp",
      "status": "fixed",
      "release": "sid",
      "version": "2026.10.26-1"
    },
    {
      "name": "yt-dlp",
      "status": "fixed",
      "release": "forky",
      "version": "2026.10.21-1"
    },
    {
      "name": "yt-dlp",
      "status": "vulnerable",
      "release": "trixie",
      "version": "2025.04.30-1"
    },
    {
      "name": "yt-dlp",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "2023.03.04-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "yt-dlp",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "2026.06.09-1"
    },
    {
      "bug": null,
      "name": "yt-dlp",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "2026.06.09-1"
    },
    {
      "bug": null,
      "name": "yt-dlp",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "yt-dlp",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "yt-dlp",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    },
    {
      "name": "yt-dlp",
      "fixed_version": "2026.06.09",
      "applicability_unknown": true
    },
    {
      "name": "yt-dlp",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.6.9"
            }
          ]
        }
      ],
      "ecosystem": "PyPI",
      "fixed_version": "2026.6.9",
      "applicability_unknown": true
    }
  ]
}

Publisher notes

[trixie] yt-dlp: Minor issue [bookworm] yt-dlp: Minor issue; only reachable when aria2c is explicitly selected as external downloader for HLS/DASH

OpenFactory catalog packages

A associação de pacotes está em andamento.

[Debian 12 (Bookworm)]

  • [yt-dlp]Desconhecido
    Detalhes (4)

    • 2023.03.04-1 · all · bookworm

      Afetada

      nvd · yt-dlp · debian · bookworm; nvd · yt-dlp · debian · 12

    • 2023.03.04-1 · all · bookworm

      Afetada

      nvd · yt-dlp · debian · bookworm; nvd · yt-dlp · debian · 12

    • 2025.04.30-1~bpo12+1 · all · bookworm-backports

      Afetada

      nvd · yt-dlp · debian · bookworm; nvd · yt-dlp · debian · 12

    • 2025.04.30-1~bpo12+1 · all · bookworm-backports

      Afetada

      nvd · yt-dlp · debian · bookworm; nvd · yt-dlp · debian · 12

[Debian 13 (Trixie)]

  • [yt-dlp]Desconhecido
    Detalhes (4)

    • 2025.04.30-1 · all · trixie

      Afetada

      nvd · yt-dlp · debian · 13

    • 2025.04.30-1 · all · trixie

      Afetada

      nvd · yt-dlp · debian · 13

    • 2026.08.19-1~bpo13+1 · all · trixie-backports

      Afetada

      nvd · yt-dlp · debian · 13

    • 2026.08.19-1~bpo13+1 · all · trixie-backports

      Afetada

      nvd · yt-dlp · debian · 13

Observado:

Referências

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]