CVE-2026-50574CWE-74

yt-dlp: Arbitrary code execution via manifest downloads with aria2c

High · published June 23, 2026

CVSS v3.1
8.3
EPSS
0%
Percentile
39.3
In the wild
Unconfirmed
What it is

yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp. This vulnerability is fixed in 2026.06.09.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00465 · 39.3th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2026-06-23T16:09Z
EPSS history
Timeline
  • 23 JUN 16:09Z
    yt-dlp: Arbitrary code execution via manifest downloads with aria2c
    cvelistv5