PyPI/yt-dlp: low

yt-dlp has dependency on potentially malicious third-party code in Douyu extractors

Action: Upgrade yt-dlp to 2024.07.07 or later.

pip install yt-dlp==2024.07.07

Affected

Fixed versions

Sources

• osv: GHSA-3v33-3wmw-3785
• https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-3v33-3wmw-3785
• https://github.com/yt-dlp/yt-dlp/commit/6075a029dba70a89675ae1250e7cdfd91f0eba41
• https://github.com/yt-dlp/yt-dlp
• https://sansec.io/research/polyfill-supply-chain-attack

published 2024-07-08T14:22:00Z · modified 2024-12-06T05:39:30.720454Z · JSON