yt-dlp up to 2026.02.20 os command injection

Summaryinfo

A vulnerability was found in yt-dlp up to 2026.02.20. It has been classified as critical. Impacted is an unknown function. The manipulation leads to os command injection. This vulnerability is traded as CVE-2026-26331. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, has been found in yt-dlp up to 2026.02.20. This issue affects an unknown code block. The manipulation with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter) is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously crafted URL. yt-dlp maintainers assume the impact of this vulnerability to be high for anyone who uses `--netrc-cmd` in their command/configuration or `netrc_cmd` in their Python scripts. Even though the maliciously crafted URL itself will look very suspicious to many users, it would be trivial for a maliciously crafted webpage with an inconspicuous URL to covertly exploit this vulnerability via HTTP redirect. Users without `--netrc-cmd` in their arguments or `netrc_cmd` in their scripts are unaffected. No evidence has been found of this exploit being used in the wild. yt-dlp version 2026.02.21 fixes this issue by validating all netrc "machine" values and raising an error upon unexpected input. As a workaround, users who are unable to upgrade should avoid using the `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter), or they should at least not pass a placeholder (`{}`) in their `--netrc-cmd` argument.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-26331 since 02/13/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1202 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 299894 (Fedora 45 : yt-dlp (2026-3d6da3d46f)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2026.02.21 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 1fbbe29b99dc61375bf6d786f824d9fcf6ea9c1a is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (299894). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Data Loss Prevention Software

Name

• yt-dlp

Version

• 2026.02.0
• 2026.02.1
• 2026.02.2
• 2026.02.3
• 2026.02.4
• 2026.02.5
• 2026.02.6
• 2026.02.7
• 2026.02.8
• 2026.02.9
• 2026.02.10
• 2026.02.11
• 2026.02.12
• 2026.02.13
• 2026.02.14
• 2026.02.15
• 2026.02.16
• 2026.02.17
• 2026.02.18
• 2026.02.19
• 2026.02.20

License

• open-source

Website

• Product: https://github.com/yt-dlp/yt-dlp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion