CVE-2026-50574

Name of the Vulnerable Software and Affected Versions yt-dlp versions prior to 2026.06.09

Description When using aria2c as an external downloader for fragmented manifest formats like HLS or DASH streams, insufficiently sanitized input allows an attacker to perform arbitrary file writes. This occurs because yt-dlp constructs an input file for aria2c using the -i option, and attackers can inject arbitrary options into this file. There are two primary attack vectors: injecting newlines via HTML escape sequences (
) in DASH manifests, or injecting newlines and magnet URIs through metadata fields like title when the --no-windows-filename option is used to disable filename sanitization.

On Windows, this can lead to immediate arbitrary code execution by writing a malicious ffmpeg.exe to the current working directory. On other platforms, arbitrary code execution can occur during subsequent invocations of yt-dlp by writing a malicious configuration file (yt-dlp.conf) containing a malicious --exec argument.

Recommendations Update to version 2026.06.09. As a temporary workaround, add --downloader dash,m3u8:native to the command line to avoid using aria2c for these formats.