Seprodev

**Name of the Vulnerable Software and Affected Versions** yt-dlp versions 2023.09.24 through 2026.06.08 **Description** When `curl` is used as an external downloader, cookies may be leaked to an unintended host during an HTTP redirect or when the host for download fragments differs from the parent manifest. This occurs because cookies passed via the `--cookie` parameter do not activate the cookie engine unless loaded from a file, causing `curl` to send cookies to domains or paths outside their intended scope. An attacker could exploit this by using a malicious website with a URL that triggers an unvalidated redirect—a situation where an application redirects a user to an external site without verifying the destination—sending sensitive cookie information to a server controlled by the attacker. **Recommendations** Update to version 2026.06.09. As a temporary workaround, do not use the `--downloader curl` option.

**Name of the Vulnerable Software and Affected Versions** yt-dlp versions prior to 2026.06.09 **Description** When using aria2c as an external downloader for fragmented manifest formats like HLS or DASH streams, insufficiently sanitized input allows an attacker to perform arbitrary file writes. This occurs because yt-dlp constructs an input file for aria2c using the `-i` option, and attackers can inject arbitrary options into this file. There are two primary attack vectors: injecting newlines via HTML escape sequences (`
`) in DASH manifests, or injecting newlines and magnet URIs through metadata fields like `title` when the `--no-windows-filename` option is used to disable filename sanitization. On Windows, this can lead to immediate arbitrary code execution by writing a malicious `ffmpeg.exe` to the current working directory. On other platforms, arbitrary code execution can occur during subsequent invocations of yt-dlp by writing a malicious configuration file (`yt-dlp.conf`) containing a malicious `--exec` argument. **Recommendations** Update to version 2026.06.09. As a temporary workaround, add `--downloader dash,m3u8:native` to the command line to avoid using aria2c for these formats.