CVE-2026-50574: yt-dlp Injection Flaw in aria2c External Downloader Enables Arbitrary File Write
CVE-2026-50574 affects yt-dlp versions before 2026.06.09 when aria2c is configured as the external downloader for fragmented manifest formats such as HLS or DASH streams. Insufficiently sanitized input passed to aria2c can allow an attacker to write arbitrary files, which the advisory states can lead to code execution. The issue is fixed in 2026.06.09.
Overview
CVE-2026-50574 is a flaw in yt-dlp, a command-line audio and video downloader. It is classified under CWE-74 (Injection). The problem appears only when aria2c is used as the external downloader for fragmented manifest formats such as HLS or DASH streams.
Impact
According to the record, an attacker could exploit insufficiently sanitized input to perform an arbitrary file write. The record states that on Windows this can lead to immediate arbitrary code execution, and on non-Windows platforms to arbitrary code execution when yt-dlp is next invoked. The NVD score is 9.6 under CVSS v3.1 and the GitHub CNA score is 8.3 under CVSS v3.1.
Affected products and versions
- Product: yt-dlp (Yt-dlp Project Yt-dlp)
- Affected range: versions before 2026.06.09
- Condition: aria2c configured as the external downloader for fragmented manifest formats
Exploitation status
The vulnerability is not listed in the CISA KEV catalog in the record consulted. No confirmed exploitation in the wild appears in the sources consulted. No EPSS value is available in the record.
Remediation and mitigation
- Upgrade yt-dlp to version 2026.06.09 or later, as referenced in the GitHub security advisory.
- Until upgrading is possible, consider not using aria2c as the external downloader, which is an inference from the affected condition described in the record.
- Review any automated pipelines or scripts that run yt-dlp with external downloader options.
Detection guidance
- Inventory yt-dlp installations and their versions across endpoints and servers.
- Identify configurations or scripts that set aria2c as an external downloader.
- Monitor for unexpected file creation or modification in directories written by yt-dlp and its downloader processes.
Limitations of the available information
The record does not describe the specific sanitization gap, the exact inputs involved, or any public proof of concept. It does not list additional affected versions or any workaround from the vendor beyond the upgrade. Exploitation activity is not reported in the sources consulted.
Frequently asked questions
Which yt-dlp versions are affected by CVE-2026-50574?
The record lists versions before 2026.06.09 as affected. The fix is available in 2026.06.09.
Does the issue only occur with a specific downloader?
According to the record, the issue applies when aria2c is used as the external downloader for fragmented manifest formats such as HLS or DASH streams.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.