PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-50574 yt-dlp CVE debrief

CVE-2026-50574 is a high-severity vulnerability in yt-dlp, a command-line audio/video downloader. Prior to version 2026.06.09, when using aria2c as an external downloader for fragmented manifest formats like HLS/DASH streams, yt-dlp passes insufficiently sanitized input. This allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, it can lead to arbitrary code execution upon the next invocation of yt-dlp. The vulnerability is fixed in version 2026.06.09. Users should update to the latest version to mitigate this risk.

Vendor
yt-dlp
Product
Unknown
CVSS
HIGH 8.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-23
Original CVE updated
2026-06-26
Advisory published
2026-06-23
Advisory updated
2026-06-26

Who should care

This vulnerability affects users of yt-dlp who use aria2c as an external downloader, especially those handling fragmented manifest formats. Windows users are at higher risk due to the potential for immediate code execution. All users should update to version 2026.06.09 or later to ensure their systems are protected.

Technical summary

The vulnerability in yt-dlp arises from insufficient input sanitization when using aria2c for downloading fragmented media streams. This allows attackers to manipulate file paths, potentially leading to arbitrary file writes. On Windows, this can result in immediate code execution, while on other platforms, it may lead to code execution on the next run of yt-dlp. The issue is resolved in version 2026.06.09, which properly sanitizes the input to prevent such attacks.

Defensive priority

High priority should be given to updating yt-dlp to version 2026.06.09 or later, especially for users who frequently handle media streams that require external downloaders like aria2c. Immediate action is recommended for Windows users due to the risk of immediate code execution.

Recommended defensive actions

  • Update yt-dlp to version 2026.06.09 or later.
  • Review and restrict the use of external downloaders like aria2c.
  • Monitor for suspicious activity related to yt-dlp and aria2c.
  • Implement additional security measures for media stream handling.
  • Regularly update and patch all software dependencies.

Evidence notes

The CVE-2026-50574 vulnerability is documented in the official CVE record and NVD detail pages. Additional information is provided in the vendor's security advisory on GitHub. These sources confirm the vulnerability's existence, its impact, and the availability of a fix in version 2026.06.09.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-50574 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-50574

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-50574 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-50574

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.