Quick answers
- Is CVE-2023-46121 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2023-46121 being exploited in the wild.
- How severe is CVE-2023-46121?
- Low severity, with a CVSS score of 3.1, published 7 July 2026.
- Which products and versions are affected?
- yt-dlp (PyPI) ECOSYSTEM:introduced=2022.10.04,fixed=2023.11.14.
- Is there a fix for CVE-2023-46121?
- Yes. yt-dlp (PyPI): upgrade to 2023.11.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2023-46121 attacked?
- It is attacked over the network.
- Am I affected by CVE-2023-46121?
- Check whether you run yt-dlp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- yt-dlp (PyPI): upgrade to 2023.11.14 or later
pip install "yt-dlp>=2023.11.14"
Technical details
The vulnerability exists in yt-dlp's URL smuggling mechanism, which allows internal data (like HTTP headers) to be passed between extractors via JSON in URL fragments. The Generic Extractor incorrectly accepts smuggled proxy headers (Ytdl-request-proxy and Ytdl-socks-proxy) from untrusted URLs, allowing an attacker to set an arbitrary HTTP/SOCKS proxy for any subsequent request. Attack requires user interaction: a user must process a malicious webpage or URL. An attacker can then intercept traffic to arbitrary sites, potentially exfiltrating non-secure cookies or injecting malicious responses. The fix removes the ability to smuggle HTTP headers to the Generic Extractor, patched in version 2023.11.14.
Affected products
- yt-dlp yt-dlp 2022.10.04 to 2023.11.13
Identifiers
- CVE-2023-46121
- GHSA-3ch3-jhc6-5r8x
- PYSEC-2026-2063
Timeline
- 2023-11-15: disclosed
- 2023-11-14: patched