PyPI/yt-dlp CVE-2026-26331: high 8.8, EPSS 2.31%

yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

Action: Upgrade yt-dlp to 2026.02.21 or later.

pip install yt-dlp==2026.02.21

Affected

Fixed versions

Sources

• osv: GHSA-g3gw-q23r-pgqm
• https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-g3gw-q23r-pgqm
• https://nvd.nist.gov/vuln/detail/CVE-2026-26331
• https://github.com/yt-dlp/yt-dlp/commit/1fbbe29b99dc61375bf6d786f824d9fcf6ea9c1a
• https://github.com/yt-dlp/yt-dlp
• https://github.com/yt-dlp/yt-dlp/releases/tag/2026.02.21

CVE-2026-26331 · published 2026-02-23T22:13:58Z · modified 2026-07-13T16:42:37.419500934Z · JSON