URI Scheme Validation Flaw in Streamlink by Streamlink

CVE-2026-44353

What is CVE-2026-44353?

Streamlink, a command-line utility designed for piping video streams from various services into video players, has a vulnerability in its HLS and DASH parsers prior to version 8.4.0. The issue arises from inadequate validation of the URI scheme for segment entries and other resources. This allows a malicious remote-hosted .m3u8 HLS playlist or .mpd DASH manifest to include local file URIs (e.g., file:///path/to/file). Consequently, when Streamlink reads from such playlists, it can inadvertently expose local file contents to output streams, leading to potential data leaks or unauthorized information disclosure. The vulnerability has been addressed in version 8.4.0.

References