CVE-2026-50574: yt-dlp project yt-dlp

csirt@kutim:~/threat-intel/cve/CVE-2026-50574

CVSS 9.6 · Critical EPSS 0,46%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada yt-dlp project yt-dlp. Skor CVSS 3.1 9.6 (Critical) menurut NVD.

Deskripsi (NVD)

yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp. This vulnerability is fixed in 2026.06.09.

Rincian

Terbit di NVD: 23 Juni 2026
Terakhir diubah: 26 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.6 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
EPSS (30 hari): 0,46% peluang dieksploitasi; lebih tinggi dari 38,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
yt-dlp project	yt-dlp	Semua versi sebelum 2026.06.09

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-vx4q-3cr2-7cg2 mitigasi · patch · advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.