Arbitrary File Write Vulnerability in yt-dlp Command-Line Tool

CVE-2026-50574

What is CVE-2026-50574?

The yt-dlp command-line audio/video downloader prior to version 2026.06.09 contains a vulnerability when using aria2c as an external downloader with fragmented manifest formats, such as HLS or DASH streams. This vulnerability allows attackers to exploit insufficiently sanitized input for arbitrary file writes. On Windows systems, this could lead to immediate execution of arbitrary code, while on non-Windows platforms, the execution could occur upon the next usage of yt-dlp. Users are advised to update to the latest version to safeguard against potential attacks.

References