Critical severity · published Jun 23, 2026
CVE-2026-50574
yt-dlp: Arbitrary code execution via manifest downloads with aria2c
9.6
CVSS
0.5%
EPSS
No
On KEV
Description
yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp. This vulnerability is fixed in 2026.06.09.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YT
yt-dlp · yt-dlp
< 2026.06.09 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-50574
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-50574
Mitigation
https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-vx4q-3cr2-7cg2
More from yt-dlp
9.6
CVE-2026-50023
yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
8.8
CVE-2026-55404
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
8.8
CVE-2026-26331
yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
7.4
CVE-2026-50019
yt-dlp: File Downloader cookie leak with curl