Remote Code Execution Vulnerability in Streamlink CLI Utility

CVE-2026-92164

What is CVE-2026-92164?

The Streamlink CLI utility, designed to pipe video streams from various services into video players, contains a vulnerability in versions prior to 8.6.0. The flaw lies in the handling of redirect responses within the HTTPSession component. Specifically, HTTPSession inherits redirect behavior from requests.Session, allowing it to process unacceptable cross-protocol redirects. As a result, a remote server can manipulate an HTTP or HTTPS URL, leading to a redirect to local file URLs. Consequently, HTTPSession could improperly read local file contents and expose them in the response. This vulnerability can be exploited during any request made through HTTPSession and could inadvertently leak sensitive local file data into the stream output. The issue has been addressed in version 8.6.0, and users are strongly advised to upgrade to this release to mitigate such risks.

References