Executive brief
Streamlink, a tool used to extract and watch video streams, is vulnerable to a flaw that allows a remote attacker to read private files from the user's computer. By tricking a user into opening a specially crafted video playlist (HLS or DASH), the attacker can force the application to include local files—such as SSH keys, cloud credentials, or system configuration—into the video output. This could lead to the theft of sensitive personal or corporate data if the resulting video file is shared, uploaded, or processed by automated systems.
Technical details
Streamlink's HLS and DASH parsers do not validate the URI scheme of segment entries, #EXT-X-KEY, or #EXT-X-MAP resources. The underlying HTTP session handler accepts 'file://' URIs, allowing a remote .m3u8 or .mpd manifest to point to local filesystem paths. When processed, Streamlink reads the targeted local files and appends their content to the output stream. Exploitation requires a user to open a malicious remote URL or for an automated system to process an attacker-controlled manifest. This can result in the disclosure of sensitive files readable by the Streamlink process, such as ~/.ssh/id_rsa or /etc/passwd. The vulnerability is addressed in version 8.4.0 by implementing a scheme allowlist (http/https) in the parsers.
Affected products
- Streamlink Streamlink <= 8.3.0
Timeline
- 2026-05-06: disclosed: Vulnerability reported and published to streamlink/streamlink repository
- 2026-05-11: advisory: GitHub Advisory GHSA-hgqw-6m45-hw5f published
- 2026-05-27: other: NVD published CVE-2026-44353