DEBIAN-CVE-2026-26331

yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's --netrc-cmd command-line option or netrccmd Python API parameter is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously...

CVE-2026-26331

yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's --netrc-cmd command-line option or netrccmd Python API parameter is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously...

UBUNTU-CVE-2026-26331

yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's --netrc-cmd command-line option or netrccmd Python API parameter is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously...

CVE-2026-26331

yt-dlp suffers an arbitrary command injection when using --netrc-cmd (or netrc_cmd) with a malicious URL. Affected versions are from 2023.06.21 up to, but not including, 2026.02.21; the fix in 2026.02.21 validates all netrc machine values and raises on unexpected input. The vulnerability can be e...

CVE-2026-26331 yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's --netrc-cmd command-line option or netrccmd Python API parameter is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously...

africanwhisper (>=0.2.8, <=0.9.0), aishell (>=2023.3.3, <=2023.4.11) +162 more potentially affected by CVE-2026-26331 via yt-dlp (>=2023.6.22, <=2026.2.4)

yt-dlp PYPI version =2023.6.22, =0.2.8, =2023.3.3, =0.1.0, =0.3.0, =0.1.0, =1.1.5, =0.1.7, =1.0.0, =0.9.0, =1.4.0, =2024.3.25, =1.1.1, =0.0.2, =0.0.5 and more Source cves: CVE-2026-26331 Source advisory: MEND:CVE-2026-26331...

CVE-2026-26331 yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's --netrc-cmd command-line option or netrccmd Python API parameter is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously...

CVE-2026-26331

yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's --netrc-cmd command-line option or netrccmd Python API parameter is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously...

CVE-2026-26331

yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's --netrc-cmd command-line option or netrccmd Python API parameter is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously...

CVE-2026-26331 yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's --netrc-cmd command-line option or netrccmd Python API parameter is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously...

CVE-2026-26331: Improper Neutralization of Special Elements used in an OS Command

yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's --netrc-cmd command-line option or netrccmd Python API parameter is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously...

CVE-2026-26331

yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's --netrc-cmd command-line option or netrccmd Python API parameter is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously...

yt-dlp operating system command injection vulnerability

yt-dlp is a branch of youtube-dl based on the now-deprecated youtube-dlc. Versions of yt-dlp from 2023.06.21 to 2026.02.21 had an operating system command injection vulnerability. This vulnerability occurred when using the --netrc-cmd command-line option, which might allow command injection,...

Fedora 45 : yt-dlp (2026-3d6da3d46f)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3d6da3d46f advisory. Automatic update for yt-dlp-2026.02.21-1.fc45. Changelog Tue Feb 24 2026 Maxwell G - 2026.02.21-1 - Update to 2026.02.21. Fixes rhbz2441709. - Mitigates...

africanwhisper (>=0.2.8, <=0.9.0), aishell (>=2023.3.3, <=2023.4.11) +162 more potentially affected by CVE-2026-26331 via yt-dlp (>=2023.6.22, <=2026.2.4)

yt-dlp PYPI version =2023.6.22, =0.2.8, =2023.3.3, =0.1.0, =0.3.0, =0.1.0, =1.1.5, =0.1.7, =1.0.0, =0.9.0, =1.4.0, =2024.3.25, =1.1.1, =0.0.2, =0.0.5 and more Source cves: CVE-2026-26331 Source advisory: SNYK:PYTHON-YTDLP-15338139...

Command Injection

Overview yt-dlp is an A youtube-dl fork with additional features and patches Affected versions of this package are vulnerable to Command Injection in the --netrc-cmd option and netrccmd API parameter, which invoke subprocess.Popen with shell=True. The GetCourseRuIE, TeachableIE, and...

africanwhisper (>=0.2.8, <=0.9.0), aishell (>=2023.3.3, <=2023.4.11) +162 more potentially affected by CVE-2026-26331 via yt-dlp (>=2023.6.22, <=2026.2.4)

yt-dlp PYPI version =2023.6.22, =0.2.8, =2023.3.3, =0.1.0, =0.3.0, =0.1.0, =1.1.5, =0.1.7, =1.0.0, =0.9.0, =1.4.0, =2024.3.25, =1.1.1, =0.0.2, =0.0.5 and more Source cves: CVE-2026-26331 Source advisory: OSV:GHSA-G3GW-Q23R-PGQM...

GHSA-G3GW-Q23R-PGQM yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

Summary When yt-dlp's --netrc-cmd command-line option or netrccmd Python API parameter is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously crafted URL. Impact yt-dlp maintainers assume the impact of this vulnerability to be high for anyone who us...

africanwhisper (>=0.2.8, <=0.9.0), aishell (>=2023.3.3, <=2023.4.11) +162 more potentially affected by CVE-2026-26331 via yt-dlp (>=2023.6.22, <=2026.2.4)

yt-dlp PYPI version =2023.6.22, =0.2.8, =2023.3.3, =0.1.0, =0.3.0, =0.1.0, =1.1.5, =0.1.7, =1.0.0, =0.9.0, =1.4.0, =2024.3.25, =1.1.1, =0.0.2, =0.0.5 and more Source cves: CVE-2026-26331 Source advisory: GHSA-G3GW-Q23R-PGQM...

yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

Summary When yt-dlp's --netrc-cmd command-line option or netrccmd Python API parameter is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously crafted URL. Impact yt-dlp maintainers assume the impact of this vulnerability to be high for anyone who us...