gridplayer (0.5.4) potentially affected by CVE-2026-44353 via streamlink (8.0.0)

streamlink PYPI version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - gridplayer 0.5.4 Source cves: CVE-2026-44353 Source advisory: OSV:PYSEC-2026-180...

CVE-2026-44353

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.4.0, Streamlink's HLS and DASH parsers do not validate the URI scheme of segment entries and other resources. A remote .m3u8 HLS playlist or .mpd DASH manifest can list file:///path/to/file...

PYSEC-2026-180

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.4.0, Streamlink's HLS and DASH parsers do not validate the URI scheme of segment entries and other resources. A remote .m3u8 HLS playlist or .mpd DASH manifest can list file:///path/to/file...

CVE-2026-44353 Streamlink: Arbitrary local file read via file:// URI in HLS and DASH

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.4.0, Streamlink's HLS and DASH parsers do not validate the URI scheme of segment entries and other resources. A remote .m3u8 HLS playlist or .mpd DASH manifest can list file:///path/to/file...

CVE-2026-44353 Streamlink: Arbitrary local file read via file:// URI in HLS and DASH

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.4.0, Streamlink's HLS and DASH parsers do not validate the URI scheme of segment entries and other resources. A remote .m3u8 HLS playlist or .mpd DASH manifest can list file:///path/to/file...

CVE-2026-44353

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.4.0, Streamlink's HLS and DASH parsers do not validate the URI scheme of segment entries and other resources. A remote .m3u8 HLS playlist or .mpd DASH manifest can list file:///path/to/file...

bsky2llm (0.1.0), downitall-android (1.5.0) +14 more potentially affected by CVE-2026-44353 via streamlink (>=0.14.2, <=8.0.0)

streamlink PYPI version =0.14.2, =0.3.0, =0.0.1, =0.0.18, =1.0.0, =0.12.0, =0.1.14, =3.0.0, =1.1.0, =0.0.1, =2.1.0, =3.4.0 - twitch-fapi-backend 0.1.0 and more Source cves: CVE-2026-44353 Source advisory: MEND:CVE-2026-44353...

EUVD-2026-32559

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.4.0, Streamlink's HLS and DASH parsers do not validate the URI scheme of segment entries and other resources. A remote .m3u8 HLS playlist or .mpd DASH manifest can list file:///path/to/file...

CVE-2026-44353 Streamlink: Arbitrary local file read via file:// URI in HLS and DASH

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.4.0, Streamlink's HLS and DASH parsers do not validate the URI scheme of segment entries and other resources. A remote .m3u8 HLS playlist or .mpd DASH manifest can list file:///path/to/file...

CVE-2026-44353

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.4.0, Streamlink's HLS and DASH parsers do not validate the URI scheme of segment entries and other resources. A remote .m3u8 HLS playlist or .mpd DASH manifest can list file:///path/to/file...

Streamlink security vulnerabilities

Streamlink is an open-source command-line tool developed by Streamlink that pushes live streaming media to video players. Versions of Streamlink prior to 8.4.0 contained security vulnerabilities. These vulnerabilities stemmed from the fact that the HLS and DASH parsers did not validate the URI...

CVE-2026-44353: Improper Limitation of a Pathname to a Restricted Directory

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.4.0, Streamlink's HLS and DASH parsers do not validate the URI scheme of segment entries and other resources. A remote .m3u8 HLS playlist or .mpd DASH manifest can list file:///path/to/file...

External Control of File Name or Path

Overview streamlink is a Streamlink is a command-line utility that extracts streams from various services and pipes them into a video player of choice. Affected versions of this package are vulnerable to External Control of File Name or Path via the parsing process for HLS and DASH playlists or...

liveproxy (>=0.0.1, <=0.1.1), pccold (>=0.12.0, <=0.32.0) potentially affected by CVE-2026-44353 via streamlink (0.14.2)

streamlink PYPI version 0.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - liveproxy =0.0.1, =0.12.0, =0.32.0 Source cves: CVE-2026-44353 Source advisory: OSV:GHSA-HGQW-6M45-HW5F...

tg-autoposter (2.1.0) potentially affected by CVE-2026-44353 via streamlink (1.5.0)

streamlink PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - tg-autoposter 2.1.0 Source cves: CVE-2026-44353 Source advisory: OSV:GHSA-HGQW-6M45-HW5F...

streamkeeper (>=1.1.0, <=2.0.1) potentially affected by CVE-2026-44353 via streamlink (1.7.0)

streamlink PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - streamkeeper =1.1.0, =2.0.1 Source cves: CVE-2026-44353 Source advisory: OSV:GHSA-HGQW-6M45-HW5F...

tg-autoposter (2.2.0) potentially affected by CVE-2026-44353 via streamlink (2.1.2)

streamlink PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - tg-autoposter 2.2.0 Source cves: CVE-2026-44353 Source advisory: OSV:GHSA-HGQW-6M45-HW5F...

mlbv (>=0.0.18, <=0.0.19), streamlinkutils (>=0.0.1, <=0.0.2) +1 more potentially affected by CVE-2026-44353 via streamlink (2.4.0)

streamlink PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - mlbv =0.0.18, =0.0.1, =0.0.2 - tg-autoposter 2.3.0 Source cves: CVE-2026-44353 Source advisory: OSV:GHSA-HGQW-6M45-HW5F...

offstream (>=1.0.0, <=1.0.2), tg-autoposter (>=2.4.0, <=2.4.1) potentially affected by CVE-2026-44353 via streamlink (3.0.3)

streamlink PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - offstream =1.0.0, =2.4.0, =2.4.1 Source cves: CVE-2026-44353 Source advisory: OSV:GHSA-HGQW-6M45-HW5F...

offstream (1.0.3) potentially affected by CVE-2026-44353 via streamlink (3.1.1)

streamlink PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on streamlink and may be impacted: - offstream 1.0.3 Source cves: CVE-2026-44353 Source advisory: OSV:GHSA-HGQW-6M45-HW5F...