RCE in Yt-Dlp
CVE-2026-26331
yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter) is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously crafted URL. yt-dlp maintainers assume the impact of this vulnerability to be high for anyone who uses `--netrc-cmd` in their command/configuration or `netrc_cmd` in their Python scripts. Even though the maliciously crafted URL itself will look very suspicious to many users, it would be trivial for a maliciously crafted webpage with an inconspicuous URL to covertly exploit this vulnerability via HTTP redirect. Users without `--netrc-cmd` in their arguments or `netrc_cmd` in their scripts are unaffected. No evidence has been found of this exploit being used in the wild. yt-dlp version 2026.02.21 fixes this issue by validating all netrc "machine" values and raising an error upon unexpected input. As a workaround, users who are unable to upgrade should avoid using the `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter), or they should at least not pass a placeholder (`{}`) in their `--netrc-cmd` argument.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.021 (81.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 81st percentile — 81.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.016 · newest: 0.021 · change: +0.005
Affected products
- Yt-Dlp — versions >= 2023.06.21, < 2026.02.21
- Yt-Dlp Project
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/yt-dlp/yt-dlp/security/advisories/GHSA-g3gw-q23r-pgqm (Exploit, Mitigation, Vendor Advisory)
- github.com/yt-dlp/yt-dlp/commit/1fbbe29b99dc61375bf6d786f824d9fcf6ea9c1a (Patch)
- github.com/yt-dlp/yt-dlp/releases/tag/2026.02.21 (Product, Release Notes)
Frequently asked questions
- What is CVE-2026-26331?
- CVE-2026-26331 is a high-severity vulnerability in Yt-Dlp, classified under OS Command Injection. CVSS score: 8.8/10. Published 2026-02-24.
- How severe is CVE-2026-26331?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2026-26331 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.