CVE-2026-50574: yt-dlp arbitrary file write via aria2c option injection

CVE-2026-50574 · Severity: high · CVSS 8.3 · Published 2026-06-23

yt-dlp is a popular command-line tool used to download video and audio from various websites. A vulnerability exists when the tool uses the 'aria2c' external downloader to process certain media streams, allowing a malicious website or manifest file to trick the tool into writing files to the user's computer. This can lead to the attacker taking full control of the system by placing malicious executable files in the tool's working directory.

Technologies: yt-dlp (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-50574 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50574 being exploited in the wild.
How severe is CVE-2026-50574?
High severity, with a CVSS score of 8.3, published 23 June 2026.
Which products and versions are affected?
yt-dlp (PyPI) < 2026.6.9, ECOSYSTEM:introduced=0,fixed=2026.6.9.
Is there a fix for CVE-2026-50574?
Yes. yt-dlp (PyPI): upgrade to 2026.6.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50574 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-50574?
Check whether you run yt-dlp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • yt-dlp (PyPI): upgrade to 2026.6.9 or later
    pip install "yt-dlp>=2026.6.9"

Technical details

A vulnerability in yt-dlp (CWE-74) arises when using aria2c as an external downloader for fragmented manifest formats like HLS or DASH. yt-dlp constructs an input file for aria2c's '-i' option but fails to properly sanitize newlines and HTML escape sequences (e.g., &#10;) in fragment URLs or metadata fields. An attacker can craft a malicious DASH manifest or metadata response to inject arbitrary aria2c options, such as 'out=', enabling arbitrary file writes. On Windows, this can lead to immediate RCE by overwriting binaries like ffmpeg.exe in the working directory; on other platforms, RCE can be achieved by writing a malicious yt-dlp.conf file. The issue is fixed in version 2026.06.09 by removing support for downloading fragmented manifests via aria2c.

Affected products

  • yt-dlp yt-dlp < 2026.06.09

Identifiers

  • CVE-2026-50574
  • GHSA-vx4q-3cr2-7cg2
  • PYSEC-2026-3433

Timeline

  • 2026-06-09: patched: Vulnerability fixed in version 2026.06.09
  • 2026-06-23: advisory: NVD and GitHub advisories published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.