CVE-2026-26331
2 advisories.
PyPI/yt-dlp CVE-2026-26331: high 8.8
yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
Action: Upgrade yt-dlp to 2026.02.21 or later.
pip install yt-dlp==2026.02.21Affected
| introduced | fixed | last affected |
|---|---|---|
| 2023.06.21 | 2026.02.21 | - |
Fixed versions
| 2026.02.21 |
Sources
- osv: GHSA-g3gw-q23r-pgqm
- https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-g3gw-q23r-pgqm
- https://nvd.nist.gov/vuln/detail/CVE-2026-26331
- https://github.com/yt-dlp/yt-dlp/commit/1fbbe29b99dc61375bf6d786f824d9fcf6ea9c1a
- https://github.com/yt-dlp/yt-dlp
- https://github.com/yt-dlp/yt-dlp/releases/tag/2026.02.21
CVE-2026-26331 · published · modified · JSON
PyPI/yt-dlp CVE-2026-26331: high 8.8
yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
Action: Upgrade yt-dlp to 2026.02.21 or later.
pip install yt-dlp==2026.02.21Affected
| introduced | fixed | last affected |
|---|---|---|
| 2023.06.21 | 2026.02.21 | - |
Fixed versions
| 2026.02.21 |
Sources
- osv: PYSEC-2026-3432
- https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-g3gw-q23r-pgqm
- https://nvd.nist.gov/vuln/detail/CVE-2026-26331
- https://github.com/yt-dlp/yt-dlp/commit/1fbbe29b99dc61375bf6d786f824d9fcf6ea9c1a
- https://github.com/yt-dlp/yt-dlp
- https://github.com/yt-dlp/yt-dlp/releases/tag/2026.02.21
- https://pypi.org/project/yt-dlp
- https://github.com/advisories/GHSA-g3gw-q23r-pgqm
CVE-2026-26331 · published · modified · JSON