PyPI/yt-dlp: high 7.5
yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp
Action: Upgrade yt-dlp to 2026.6.9 or later.
pip install yt-dlp==2026.6.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 2021.4.11 | 2026.6.9 | - |
Fixed versions
| 2026.6.9 |
Sources
- osv: GHSA-69qj-pvh9-c5wg
- https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-69qj-pvh9-c5wg
- https://github.com/yt-dlp/yt-dlp/pull/16883
- https://github.com/yt-dlp/yt-dlp/commit/5faffa999fd33b373d47773e8ee639d072accec2
- https://github.com/yt-dlp/yt-dlp
- https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2026.06.06.234447
- https://github.com/yt-dlp/yt-dlp/releases/tag/2026.06.09
published · modified · JSON