Is CVE-2026-50019 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50019 being exploited in the wild.

How severe is CVE-2026-50019?

Medium severity, with a CVSS score of 6.1, published 23 June 2026.

Which products and versions are affected?

yt-dlp (PyPI) >= 2023.9.24, < 2026.6.9, ECOSYSTEM:introduced=2023.9.24,fixed=2026.6.9.

Is there a fix for CVE-2026-50019?

Yes. yt-dlp (PyPI): upgrade to 2026.6.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50019 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-50019?

Check whether you run yt-dlp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50019: yt-dlp cookie leak when using curl as external downloader

Q: Is there a fix for CVE-2026-50019?

Yes. yt-dlp (PyPI): upgrade to 2026.6.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-50019 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-50019?

Check whether you run yt-dlp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50019 · Severity: medium · CVSS 6.1 · Published 2026-06-23

yt-dlp is a popular command-line tool used to download audio and video from various websites. A security flaw exists where, if the tool is configured to use 'curl' as its downloader, sensitive login cookies can be accidentally sent to unauthorized third-party servers. This could allow an attacker to hijack a user's session or access private account data if the user is tricked into downloading a malicious link.

Technologies: yt-dlp (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-50019 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50019 being exploited in the wild.
How severe is CVE-2026-50019?: Medium severity, with a CVSS score of 6.1, published 23 June 2026.
Which products and versions are affected?: yt-dlp (PyPI) >= 2023.9.24, < 2026.6.9, ECOSYSTEM:introduced=2023.9.24,fixed=2026.6.9.
Is there a fix for CVE-2026-50019?: Yes. yt-dlp (PyPI): upgrade to 2026.6.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50019 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-50019?: Check whether you run yt-dlp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

yt-dlp (PyPI): upgrade to 2026.6.9 or later
```
pip install "yt-dlp>=2026.6.9"
```

Technical details

A vulnerability in yt-dlp exists when curl is utilized as an external downloader via the --downloader flag. When yt-dlp passes cookies to curl using the --cookie command-line argument, curl does not activate its internal cookie engine unless the cookies are loaded from a file. Consequently, curl fails to respect cookie scoping (domain and path restrictions) and will forward these cookies to unintended hosts during HTTP redirects or when download fragments are hosted on different domains than the parent manifest. Attackers can exploit this by providing a URL that performs an unvalidated redirect to a malicious server. The issue is resolved in version 2026.06.09 by ensuring cookies are passed via stdin or temporary files to properly trigger curl's cookie engine.

Affected products

yt-dlp yt-dlp >= 2023.09.24, < 2026.06.09

Identifiers

CVE-2026-50019
GHSA-f7j3-774f-rfhj
PYSEC-2026-3431

Timeline

2023-09-24: other: Vulnerable behavior introduced
2026-06-09: patched: Fixed in version 2026.06.09
2026-06-23: disclosed: Public advisory published

References

https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-f7j3-774f-rfhj

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.