{"action":"Upgrade yt-dlp to 2024.07.07 or later.","affected":[{"fixed":"2024.07.07","introduced":"2023.09.24"}],"component":"yt-dlp","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["2024.07.07"],"ghsa_id":"GHSA-3v33-3wmw-3785","id":"tcs_01M5KEWFFMT1P6223MWM4VWYRQ","modified_at":"2024-12-06T05:39:30.720454Z","published_at":"2024-07-08T14:22:00Z","references":["https://osv.dev/vulnerability/GHSA-3v33-3wmw-3785","https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-3v33-3wmw-3785","https://github.com/yt-dlp/yt-dlp/commit/6075a029dba70a89675ae1250e7cdfd91f0eba41","https://github.com/yt-dlp/yt-dlp","https://sansec.io/research/polyfill-supply-chain-attack"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-3v33-3wmw-3785","url":"https://osv.dev/vulnerability/GHSA-3v33-3wmw-3785"}],"summary":"yt-dlp has dependency on potentially malicious third-party code in Douyu extractors"}