MEDIUM5.0PyPI
GHSA-3ch3-jhc6-5r8x· CVE-2023-46121, PYSEC-2026-2063yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection
Modified: 9/10/2026
package
PyPI/yt-dlp
pkg:pypi/yt-dlp
LOWPyPI
GHSA-3v33-3wmw-3785yt-dlp has dependency on potentially malicious third-party code in Douyu extractors
Modified: 12/6/2024
HIGH8.3PyPI
GHSA-42h4-v29r-42qg· CVE-2023-40581, PYSEC-2026-2064yt-dlp on Windows vulnerable to `--exec` command injection when using `%q`
Modified: 7/7/2026
HIGH7.5PyPI
GHSA-69qj-pvh9-c5wgyt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp
Modified: 6/16/2026
HIGH7.5PyPI
GHSA-6v4j-43gg-vj32· CVE-2026-55404, PYSEC-2026-3622yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
Modified: 8/4/2026
HIGH7.8PyPI
GHSA-79w7-vh3h-8g4j· CVE-2024-38519, PYSEC-2026-2065yt-dlp File system modification and RCE through improper file-extension sanitization
Modified: 7/7/2026
HIGH8.3PyPI
GHSA-c6mh-fpjc-4pr3· CVE-2026-50023, PYSEC-2026-3430yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
Modified: 7/20/2026
MEDIUM6.1PyPI
GHSA-f7j3-774f-rfhj· CVE-2026-50019, PYSEC-2026-3431yt-dlp: File Downloader cookie leak with curl
Modified: 7/20/2026
HIGH8.8PyPI
GHSA-g3gw-q23r-pgqm· CVE-2026-26331, PYSEC-2026-3432yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
Modified: 7/13/2026
HIGH8.3PyPI
GHSA-hjq6-52gw-2g7p· CVE-2024-22423, PYSEC-2026-2066yt-dlp: `--exec` command injection when using `%q` in yt-dlp on Windows (Bypass of CVE-2023-40581)
Modified: 7/7/2026
MEDIUM6.1PyPI
GHSA-v8mc-9377-rwjj· CVE-2023-35934, PYSEC-2026-2067yt-dlp File Downloader cookie leak
Modified: 9/10/2026
HIGH8.3PyPI
GHSA-vx4q-3cr2-7cg2· CVE-2026-50574, PYSEC-2026-3433yt-dlp: Arbitrary code execution via manifest downloads with aria2c
Modified: 7/20/2026
MEDIUM5.0PyPI
PYSEC-2026-2063· CVE-2023-46121, GHSA-3ch3-jhc6-5r8xyt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection
Modified: 7/7/2026
HIGH8.3PyPI
PYSEC-2026-2064· CVE-2023-40581, GHSA-42h4-v29r-42qgyt-dlp on Windows vulnerable to `--exec` command injection when using `%q`
Modified: 7/7/2026
HIGH7.8PyPI
PYSEC-2026-2065· CVE-2024-38519, GHSA-79w7-vh3h-8g4jyt-dlp File system modification and RCE through improper file-extension sanitization
Modified: 7/7/2026
HIGH8.3PyPI
PYSEC-2026-2066· CVE-2024-22423, GHSA-hjq6-52gw-2g7pyt-dlp: `--exec` command injection when using `%q` in yt-dlp on Windows (Bypass of CVE-2023-40581)
Modified: 7/7/2026
MEDIUM6.1PyPI
PYSEC-2026-2067· CVE-2023-35934, GHSA-v8mc-9377-rwjjyt-dlp File Downloader cookie leak
Modified: 7/7/2026
HIGH8.3PyPI
PYSEC-2026-3430· CVE-2026-50023, GHSA-c6mh-fpjc-4pr3yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
Modified: 7/13/2026
MEDIUM6.1PyPI
PYSEC-2026-3431· CVE-2026-50019, GHSA-f7j3-774f-rfhjyt-dlp: File Downloader cookie leak with curl
Modified: 7/13/2026
HIGH8.8PyPI
PYSEC-2026-3432· CVE-2026-26331, GHSA-g3gw-q23r-pgqmyt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
Modified: 7/13/2026
HIGH8.3PyPI
PYSEC-2026-3433· CVE-2026-50574, GHSA-vx4q-3cr2-7cg2yt-dlp: Arbitrary code execution via manifest downloads with aria2c
Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-3622· CVE-2026-55404, GHSA-6v4j-43gg-vj32yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
Modified: 8/4/2026