https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 08:23:05 +0000 https://cve.radiocsirt.org/vuln/brew-gamdl-cve-2026-50574 <p><strong>Affected:</strong> Homebrew: gamdl</p> <p>### Summary If aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp.</p> <p>### Details When downloading a fragmented manifest format such as an HLS or DASH stream, yt-dlp first extracts a list of all fragment URLs from the stream&#39;s manifest. If the user has selected aria2c as an external downloader, yt-dlp then constructs an input file for aria2c from the fragment URL list and passes its filepath as the argument to aria2c&#39;s `-i` option.</p> <p>aria2c&#39;s `-i` (or `--input-file`) option allows for downloading a list of URIs from the given text file. The text file must be formatted as a list of URIs separated by newlines. aria2c&#39;s format permits configuration lines for each URI, which can contain command-line options to be given to aria2c. These optional lines follow each URI line and are signified only by leading whitespace. yt-dlp constructs the input file with these optional lines so that it&#39;s able to specify the output filename for each fragment using the `out=` option.</p> <p>yt-dlp&#39;s utilization of the aria2c input file format presents two known attack vectors:</p> <p>1. An attacker can craft a malicious DASH manifest with one or more fragment URLs that cont…</p> <p><strong>Affected:</strong> Homebrew: gamdl</p> <p>### Summary If aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp.</p> <p>### Details When downloading a fragmented manifest format such as an HLS or DASH stream, yt-dlp first extracts a list of all fragment URLs from the stream&#39;s manifest. If the user has selected aria2c as an external downloader, yt-dlp then constructs an input file for aria2c from the fragment URL list and passes its filepath as the argument to aria2c&#39;s `-i` option.</p> <p>aria2c&#39;s `-i` (or `--input-file`) option allows for downloading a list of URIs from the given text file. The text file must be formatted as a list of URIs separated by newlines. aria2c&#39;s format permits configuration lines for each URI, which can contain command-line options to be given to aria2c. These optional lines follow each URI line and are signified only by leading whitespace. yt-dlp constructs the input file with these optional lines so that it&#39;s able to specify the output filename for each fragment using the `out=` option.</p> <p>yt-dlp&#39;s utilization of the aria2c input file format presents two known attack vectors:</p> <p>1. An attacker can craft a malicious DASH manifest with one or more fragment URLs that cont…</p> https://cve.radiocsirt.org/vuln/brew-gamdl-cve-2026-50574 https://cve.radiocsirt.org/vuln/euvd-2026-330062 EUVD-2026-330062 https://cve.radiocsirt.org/vuln/euvd-2026-330062 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50574 <p>yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp. This vulnerability is fixed in 2026.06.09.</p> <p>yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp. This vulnerability is fixed in 2026.06.09.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-50574 https://cve.radiocsirt.org/vuln/ghsa-vx4q-3cr2-7cg2 <p><strong>Affected:</strong> PyPI: yt-dlp</p> <p>### Summary If aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp.</p> <p>### Details When downloading a fragmented manifest format such as an HLS or DASH stream, yt-dlp first extracts a list of all fragment URLs from the stream&#39;s manifest. If the user has selected aria2c as an external downloader, yt-dlp then constructs an input file for aria2c from the fragment URL list and passes its filepath as the argument to aria2c&#39;s `-i` option.</p> <p>aria2c&#39;s `-i` (or `--input-file`) option allows for downloading a list of URIs from the given text file. The text file must be formatted as a list of URIs separated by newlines. aria2c&#39;s format permits configuration lines for each URI, which can contain command-line options to be given to aria2c. These optional lines follow each URI line and are signified only by leading whitespace. yt-dlp constructs the input file with these optional lines so that it&#39;s able to specify the output filename for each fragment using the `out=` option.</p> <p>yt-dlp&#39;s utilization of the aria2c input file format presents two known attack vectors:</p> <p>1. An attacker can craft a malicious DASH manifest with one or more fragment URLs that cont…</p> <p><strong>Affected:</strong> PyPI: yt-dlp</p> <p>### Summary If aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp.</p> <p>### Details When downloading a fragmented manifest format such as an HLS or DASH stream, yt-dlp first extracts a list of all fragment URLs from the stream&#39;s manifest. If the user has selected aria2c as an external downloader, yt-dlp then constructs an input file for aria2c from the fragment URL list and passes its filepath as the argument to aria2c&#39;s `-i` option.</p> <p>aria2c&#39;s `-i` (or `--input-file`) option allows for downloading a list of URIs from the given text file. The text file must be formatted as a list of URIs separated by newlines. aria2c&#39;s format permits configuration lines for each URI, which can contain command-line options to be given to aria2c. These optional lines follow each URI line and are signified only by leading whitespace. yt-dlp constructs the input file with these optional lines so that it&#39;s able to specify the output filename for each fragment using the `out=` option.</p> <p>yt-dlp&#39;s utilization of the aria2c input file format presents two known attack vectors:</p> <p>1. An attacker can craft a malicious DASH manifest with one or more fragment URLs that cont…</p> https://cve.radiocsirt.org/vuln/ghsa-vx4q-3cr2-7cg2 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11019-1 <p>python313-yt-dlp-2026.06.09-1.1 on GA media</p> <p>python313-yt-dlp-2026.06.09-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11019-1 https://cve.radiocsirt.org/vuln/pysec-2026-3433 <p><strong>Affected:</strong> PyPI: yt-dlp</p> <p>### Summary If aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp.</p> <p>### Details When downloading a fragmented manifest format such as an HLS or DASH stream, yt-dlp first extracts a list of all fragment URLs from the stream&#39;s manifest. If the user has selected aria2c as an external downloader, yt-dlp then constructs an input file for aria2c from the fragment URL list and passes its filepath as the argument to aria2c&#39;s `-i` option.</p> <p>aria2c&#39;s `-i` (or `--input-file`) option allows for downloading a list of URIs from the given text file. The text file must be formatted as a list of URIs separated by newlines. aria2c&#39;s format permits configuration lines for each URI, which can contain command-line options to be given to aria2c. These optional lines follow each URI line and are signified only by leading whitespace. yt-dlp constructs the input file with these optional lines so that it&#39;s able to specify the output filename for each fragment using the `out=` option.</p> <p>yt-dlp&#39;s utilization of the aria2c input file format presents two known attack vectors:</p> <p>1. An attacker can craft a malicious DASH manifest with one or more fragment URLs that cont…</p> <p><strong>Affected:</strong> PyPI: yt-dlp</p> <p>### Summary If aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp.</p> <p>### Details When downloading a fragmented manifest format such as an HLS or DASH stream, yt-dlp first extracts a list of all fragment URLs from the stream&#39;s manifest. If the user has selected aria2c as an external downloader, yt-dlp then constructs an input file for aria2c from the fragment URL list and passes its filepath as the argument to aria2c&#39;s `-i` option.</p> <p>aria2c&#39;s `-i` (or `--input-file`) option allows for downloading a list of URIs from the given text file. The text file must be formatted as a list of URIs separated by newlines. aria2c&#39;s format permits configuration lines for each URI, which can contain command-line options to be given to aria2c. These optional lines follow each URI line and are signified only by leading whitespace. yt-dlp constructs the input file with these optional lines so that it&#39;s able to specify the output filename for each fragment using the `out=` option.</p> <p>yt-dlp&#39;s utilization of the aria2c input file format presents two known attack vectors:</p> <p>1. An attacker can craft a malicious DASH manifest with one or more fragment URLs that cont…</p> https://cve.radiocsirt.org/vuln/pysec-2026-3433 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-50574 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: yt-dlp, Ubuntu:24.04:LTS: yt-dlp, Ubuntu:25.10: yt-dlp, Ubuntu:26.04:LTS: yt-dlp</p> <p>yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp. This vulnerability is fixed in 2026.06.09.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: yt-dlp, Ubuntu:24.04:LTS: yt-dlp, Ubuntu:25.10: yt-dlp, Ubuntu:26.04:LTS: yt-dlp</p> <p>yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp. This vulnerability is fixed in 2026.06.09.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-50574