How many yt-dlp project yt-dlp CVEs are in CISA KEV?

None of yt-dlp project yt-dlp's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of yt-dlp project yt-dlp are affected?

23 distinct yt-dlp project yt-dlp versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in yt-dlp project yt-dlp CVEs?

yt-dlp project yt-dlp's CVEs most often map to these CWE weakness types: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')).

How many critical yt-dlp project yt-dlp vulnerabilities are there?

yt-dlp project yt-dlp has 4 critical and 7 high-severity CVEs.

What is the average severity of yt-dlp project yt-dlp CVEs?

The average CVSS base score across yt-dlp project yt-dlp's scored CVEs is 8.4.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

yt-dlp project

12 CVEs

yt-dlp project yt-dlp Vulnerabilities

Name: yt-dlp project yt-dlp vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for yt-dlp by yt-dlp project.

12

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

4

Public exploits

PoC or exploit code

8.4

Avg CVSS

2023–2026

Last updated July 8, 2026

Overview

yt-dlp project yt-dlp has 12 published CVE records since 2023, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 4 have a known public exploit. The average CVSS base score across scored CVEs is 8.4.

This page aggregates every publicly disclosed vulnerability (CVE) affecting yt-dlp project yt-dlp, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list. Affected platforms include windows.

Severity and exploitation

How the CVSS severity of yt-dlp project yt-dlp's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical4

High7

Medium1

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of yt-dlp project yt-dlp's CVEs are currently listed in CISA's KEV catalog.

Public exploits

4

4 of yt-dlp project yt-dlp's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every yt-dlp project yt-dlp version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

< 2026.06.092 CVEs
2021.04.11 <= v < 2024.04.092 CVEs
< 2023.07.061 CVE
< 2023.07.06.1855191 CVE
< 2024.07.011 CVE
< 2025.07.211 CVE
< 2026.07.041 CVE
< nightly 2023.09.24.0030441 CVE
2021.04.11 <= v < 2023.09.241 CVE
2022.10.04 <= v < 2023.11.141 CVE
2023.06.21 <= v < 2026.02.211 CVE
2023.09.24 <= v < 2026.06.091 CVE

Fixed in

2026.06.093 CVEs
2024.04.092 CVEs
2023.07.061 CVE
2023.07.06.1855191 CVE
2023.09.241 CVE
2023.11.141 CVE
2024.07.011 CVE
2025.07.211 CVE
2026.02.211 CVE
2026.07.041 CVE
nightly 2023.09.24.0030441 CVE

Find a version

12 CVEs

Sort

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
CVE-2026-55404
Patch
CWE-74
High · CVSS 8.8
EPSS 0.4% (34th pct)2026-07-08
yt-dlp: File Downloader cookie leak with curl
CVE-2026-50019
Patch
CWE-200
High · CVSS 7.4
EPSS 0.3% (19th pct)2026-06-23
yt-dlp: Arbitrary code execution via manifest downloads with aria2c
CVE-2026-50574
Patch
CWE-74
Critical · CVSS 9.6
EPSS 0.4% (33th pct)2026-06-23
yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
CVE-2026-50023
Public exploit
Patch
CWE-641
Critical · CVSS 9.6
EPSS 0.6% (46th pct)2026-06-23
yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
CVE-2026-26331
Patch
CWE-78
High · CVSS 8.8
EPSS 1.6% (73th pct)2026-02-24
yt-dlp allows `--exec` command injection when using placeholder on Windows
CVE-2025-54072
Public exploit
Patch
CWE-78
High · CVSS 8.1
EPSS 0.6% (43th pct)2025-07-22
High vulnerability · 2024-07-02
CVE-2024-38519
Public exploit
Patch
CWE-669
High · CVSS 7.8
EPSS 0.3% (25th pct)2024-07-02
Command injection vulnerability in programing languages on Microsoft Windows operating system.
CVE-2024-3566
Public exploit
Patch
Critical · CVSS 9.8
EPSS 6.9% (93th pct)2024-04-10
Critical vulnerability · 2024-04-09
CVE-2024-22423
Patch
CWE-78
Critical · CVSS 9.8
EPSS 1.3% (66th pct)2024-04-09
Medium vulnerability · 2023-11-14
CVE-2023-46121
Patch
CWE-444
Medium · CVSS 5.0
EPSS 0.3% (24th pct)2023-11-14
yt-dlp command injection when using `%q` in `--exec` on Windows
CVE-2023-40581
Patch
CWE-78
High · CVSS 8.4
EPSS 1.3% (67th pct)2023-09-25
High vulnerability · 2023-07-06
CVE-2023-35934
Patch
CWE-200
High · CVSS 8.2
EPSS 1.0% (60th pct)2023-07-06

Common weakness types

The CWE weakness categories most often found in yt-dlp project yt-dlp CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many yt-dlp project yt-dlp CVEs were published each year.

2023

3

2024

3

2025

1

2026

5

Other yt-dlp project products

Browse vulnerabilities for other products by yt-dlp project.

All yt-dlp project vulnerabilities

Frequently asked questions

Common questions about yt-dlp project yt-dlp vulnerabilities.

How many CVEs does yt-dlp project yt-dlp have?: yt-dlp project yt-dlp has 12 published CVE records since 2023.
How many yt-dlp project yt-dlp CVEs are in CISA KEV?: None of yt-dlp project yt-dlp's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for yt-dlp project yt-dlp vulnerabilities?: Yes — 4 of yt-dlp project yt-dlp's CVEs have a known public exploit.
Which versions of yt-dlp project yt-dlp are affected?: 23 distinct yt-dlp project yt-dlp versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in yt-dlp project yt-dlp CVEs?: yt-dlp project yt-dlp's CVEs most often map to these CWE weakness types: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')).
How many critical yt-dlp project yt-dlp vulnerabilities are there?: yt-dlp project yt-dlp has 4 critical and 7 high-severity CVEs.
What is the average severity of yt-dlp project yt-dlp CVEs?: The average CVSS base score across yt-dlp project yt-dlp's scored CVEs is 8.4.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track yt-dlp project yt-dlp vulnerabilities

Monitor new yt-dlp project yt-dlp vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing