Executive brief
yt-dlp is a popular command-line tool used to download audio and video from various websites. A security flaw exists where, if the tool is configured to use 'curl' as its downloader, sensitive login cookies can be accidentally sent to unauthorized third-party servers. This could allow an attacker to hijack a user's session or access private account data if the user is tricked into downloading a malicious link.
Technical details
A vulnerability in yt-dlp exists when curl is utilized as an external downloader via the --downloader flag. When yt-dlp passes cookies to curl using the --cookie command-line argument, curl does not activate its internal cookie engine unless the cookies are loaded from a file. Consequently, curl fails to respect cookie scoping (domain and path restrictions) and will forward these cookies to unintended hosts during HTTP redirects or when download fragments are hosted on different domains than the parent manifest. Attackers can exploit this by providing a URL that performs an unvalidated redirect to a malicious server. The issue is resolved in version 2026.06.09 by ensuring cookies are passed via stdin or temporary files to properly trigger curl's cookie engine.
Affected products
- yt-dlp yt-dlp >= 2023.09.24, < 2026.06.09
Timeline
- 2023-09-24: other: Vulnerable behavior introduced
- 2026-06-09: patched: Fixed in version 2026.06.09
- 2026-06-23: disclosed: Public advisory published