yt-dlp: File Downloader cookie leak with curl
Summary
If curl is used an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's.
This is the equivalent to GHSA-v8mc-9377-rwjj for the curl downloader. The vulnerable behavior is present in yt-dlp released since 2023.09.24.
Details
At the file download stage, the cookies are passed by yt-dlp to the file downloader via --cookie. However, unless these are loaded from a file, this operation does not activate the cookie engine. As a result, curl will send cookies with requests to domains or paths for which the cookies are not scoped.
An example of a potential attack scenario exploiting this vulnerability:
- an attacker has crafted a malicious website with an embedded URL designed to be detected by yt-dlp as a video download. This embedded URL has the domain of a trusted site that the user has loaded cookies for, and conducts an unvalidated redirect to a target URL.
- yt-dlp extracts this URL and calculates the cookies which are then passed to
curl. - the download URL redirects to a server controlled by the attacker, to which
curlforwards the user's sensitive cookie information.
Patches
yt-dlp version 2026.06.09 fixes this issue by doing the following:
- Pass the cookies through stdin via
--cookie -ifcurlis version 7.59 or higher. - Pass the cookies via
--cookie /dev/fd/0if the system supports this device file. - In all other cases create a temporary file, save the cookies and then pass via
--cookie <file>.
Workarounds
It is recommended to upgrade yt-dlp to version 2026.06.09 as soon as possible.
For users who are not able to upgrade:
- Do not use
--downloader curl.
Czego dotyczy
Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.
| Platforma | Paczka | Podatne wersje | Poprawka w wersji |
|---|---|---|---|
| Python (PyPI) | yt-dlp | >= 2023.9.24, < 2026.6.9 | 2026.6.9 |
Odnośniki
- https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-f7j3-774f-rfhj
- https://github.com/yt-dlp/yt-dlp/commit/2726572520238356bcf64aba2040228648b44c82
- https://github.com/yt-dlp/yt-dlp
- https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2026.06.09.230517
- https://github.com/yt-dlp/yt-dlp/releases/tag/2026.06.09
- https://pypi.org/project/yt-dlp
- https://github.com/advisories/GHSA-f7j3-774f-rfhj
- https://nvd.nist.gov/vuln/detail/CVE-2026-50019
- https://github.com/pypa/advisory-database/tree/main/vulns/yt-dlp/PYSEC-2026-3431.yaml
- Wektor CVSS
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N- Słabość (CWE)
CWE-200- Platforma
- Python (PyPI)
- Paczka
yt-dlp- Ujawniono
- 16.06.2026
- Aktualizacja
- 11.10.2026 14:18
Źródła i licencje
OSV / GitHub Advisory Database - PYSEC-2026-3431 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-f7j3-774f-rfhj - CC BY 4.0
Historia podatności: yt-dlp
Wszystkie opisane podatności tej paczki (Python (PyPI)), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.
- Wszystkich wpisów
- 12
- Pierwsza → ostatnia
- 07.2023 07.2026
- Bez poprawki
- 0
- Wykorzystywana w atakach
- 0
Rozkład istotności
- Wysoka 8
- Średnia 3
- Niska 1
Ujawnienia w latach
- 2023: 3
- 2024: 3
- 2025: 0
- 2026: 6
-
yt-dlp: File Downloader cookie leak with curl ten wpis
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.