# yt-dlp (PyPI) vulnerabilities

Source: https://junglewise.ai/threats/technologies/yt-dlp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/yt-dlp.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 12 vulnerabilities in yt-dlp (PyPI): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-26331, was published on 13 July 2026.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 0
- All time: 12 (0 critical, 0 exploited in the wild)

## About yt-dlp (PyPI)

A command-line program for downloading video and audio from YouTube and other websites.

## Latest yt-dlp (PyPI) vulnerabilities

- [CVE-2026-26331: PYSEC-2026-3432 - yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option](https://junglewise.ai/threats/cve-2026-26331-yt-dlp-arbitrary-command-injection-when-using-the-netrc-cmd) (low, CVSS 3.1, published 13 Jul 2026)
- [CVE-2026-55404: yt-dlp and youtube-dl command injection in shortcut file generation](https://junglewise.ai/threats/cve-2026-55404-yt-dlp-and-youtube-dl-command-injection-in-shortcut-file) (high, CVSS 7.5, published 8 Jul 2026)
- [CVE-2024-38519: PYSEC-2026-2065 - yt-dlp File system modification and RCE through improper file-extension sanitization](https://junglewise.ai/threats/cve-2024-38519-yt-dlp-file-system-modification-and-rce-through-improper-file) (low, CVSS 3.1, published 7 Jul 2026)
- [CVE-2024-22423: PYSEC-2026-2066 - yt-dlp: `--exec` command injection when using `%q` in yt-dlp on Windows (Bypass of )](https://junglewise.ai/threats/cve-2024-22423-yt-dlp-exec-command-injection-when-using-q-in-yt-dlp-on-windows) (low, CVSS 3.1, published 7 Jul 2026)
- [CVE-2023-46121: PYSEC-2026-2063 - yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection](https://junglewise.ai/threats/cve-2023-46121-yt-dlp-generic-extractor-mitm-via-arbitrary-proxy-injection) (low, CVSS 3.1, published 7 Jul 2026)
- [CVE-2023-40581: PYSEC-2026-2064 - yt-dlp on Windows vulnerable to `--exec` command injection when using `%q`](https://junglewise.ai/threats/cve-2023-40581-yt-dlp-on-windows-vulnerable-to-exec-command-injection-when-using) (low, CVSS 3.1, published 7 Jul 2026)
- [CVE-2023-35934: PYSEC-2026-2067 - yt-dlp File Downloader cookie leak](https://junglewise.ai/threats/cve-2023-35934-yt-dlp-file-downloader-cookie-leak) (low, CVSS 3.1, published 7 Jul 2026)
- [CVE-2026-50574: yt-dlp arbitrary file write via aria2c option injection](https://junglewise.ai/threats/cve-2026-50574-yt-dlp-arbitrary-file-write-via-aria2c-option-injection) (high, CVSS 8.3, published 23 Jun 2026)
- [CVE-2026-50023: yt-dlp arbitrary file write via OS-shortcut extensions](https://junglewise.ai/threats/cve-2026-50023-yt-dlp-arbitrary-file-write-via-os-shortcut-extensions) (high, CVSS 8.3, published 23 Jun 2026)
- [CVE-2026-50019: yt-dlp cookie leak when using curl as external downloader](https://junglewise.ai/threats/cve-2026-50019-yt-dlp-cookie-leak-when-using-curl-as-external-downloader) (medium, CVSS 6.1, published 23 Jun 2026)
- [yt-dlp command injection in --exec option](https://junglewise.ai/threats/yt-dlp-command-injection-in-exec-option-89f9590f) (high, CVSS 7.5, published 16 Jun 2026)
- [yt-dlp has dependency on potentially malicious third-party code in Douyu extractors](https://junglewise.ai/threats/yt-dlp-has-dependency-on-potentially-malicious-third-party-code-in-df97dcc4) (info, published 8 Jul 2024)

## Most severe yt-dlp (PyPI) vulnerabilities

- [CVE-2026-50023: yt-dlp arbitrary file write via OS-shortcut extensions](https://junglewise.ai/threats/cve-2026-50023-yt-dlp-arbitrary-file-write-via-os-shortcut-extensions) (high, CVSS 8.3, published 23 Jun 2026)
- [CVE-2026-50574: yt-dlp arbitrary file write via aria2c option injection](https://junglewise.ai/threats/cve-2026-50574-yt-dlp-arbitrary-file-write-via-aria2c-option-injection) (high, CVSS 8.3, published 23 Jun 2026)
- [CVE-2026-55404: yt-dlp and youtube-dl command injection in shortcut file generation](https://junglewise.ai/threats/cve-2026-55404-yt-dlp-and-youtube-dl-command-injection-in-shortcut-file) (high, CVSS 7.5, published 8 Jul 2026)
- [yt-dlp command injection in --exec option](https://junglewise.ai/threats/yt-dlp-command-injection-in-exec-option-89f9590f) (high, CVSS 7.5, published 16 Jun 2026)
- [CVE-2026-50019: yt-dlp cookie leak when using curl as external downloader](https://junglewise.ai/threats/cve-2026-50019-yt-dlp-cookie-leak-when-using-curl-as-external-downloader) (medium, CVSS 6.1, published 23 Jun 2026)
- [CVE-2026-26331: PYSEC-2026-3432 - yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option](https://junglewise.ai/threats/cve-2026-26331-yt-dlp-arbitrary-command-injection-when-using-the-netrc-cmd) (low, CVSS 3.1, published 13 Jul 2026)
- [CVE-2023-40581: PYSEC-2026-2064 - yt-dlp on Windows vulnerable to `--exec` command injection when using `%q`](https://junglewise.ai/threats/cve-2023-40581-yt-dlp-on-windows-vulnerable-to-exec-command-injection-when-using) (low, CVSS 3.1, published 7 Jul 2026)
- [CVE-2024-22423: PYSEC-2026-2066 - yt-dlp: `--exec` command injection when using `%q` in yt-dlp on Windows (Bypass of )](https://junglewise.ai/threats/cve-2024-22423-yt-dlp-exec-command-injection-when-using-q-in-yt-dlp-on-windows) (low, CVSS 3.1, published 7 Jul 2026)
- [CVE-2023-35934: PYSEC-2026-2067 - yt-dlp File Downloader cookie leak](https://junglewise.ai/threats/cve-2023-35934-yt-dlp-file-downloader-cookie-leak) (low, CVSS 3.1, published 7 Jul 2026)
- [CVE-2024-38519: PYSEC-2026-2065 - yt-dlp File system modification and RCE through improper file-extension sanitization](https://junglewise.ai/threats/cve-2024-38519-yt-dlp-file-system-modification-and-rce-through-improper-file) (low, CVSS 3.1, published 7 Jul 2026)

## Vulnerabilities per week

Nothing was published in the last eight weeks.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other PyPI technologies

- [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities
- [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities
- [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities
- [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities
- [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities
- [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities
- [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities
- [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities
- [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities
- [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities
- [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities
- [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "yt-dlp (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/yt-dlp, 13 November 2026.