yt-dlp
A feature-rich command-line audio/video downloader
View on Github
Activity
- Latest release
- 2d ago
- Total releases
- 647
- Cadence
- ~daily
- Last 12 months
- 149
Reach
- Stars
- 203.5k
Details
- License
- Unlicense
- First release
- Jan 15, 2021
| Version | Released | |
|---|---|---|
2026.10.26
patch
| ||
2026.10.26.220202.dev0
pre
|
2026.10.26.220202.dev0
pre
Dependencies (18)
+ 10 more
Changelog
Compare changes
|
|
2026.10.23.233055.dev0
pre
|
2026.10.23.233055.dev0
pre
Dependencies (18)
+ 10 more
Changelog
Compare changes
|
|
2026.10.21.233146.dev0
pre
|
2026.10.21.233146.dev0
pre
Dependencies (18)
+ 10 more
Changelog
Compare changes
|
|
2026.10.21
minor
| ||
2026.10.21.202512.dev0
pre
|
2026.10.21.202512.dev0
pre
Dependencies (19)
+ 11 more
Changelog
Compare changes
|
|
2026.10.10.233141.dev0
pre
| ||
2026.9.27.232945.dev0
pre
| ||
2026.9.16.232951.dev0
pre
| ||
2026.8.30.232658.dev0
pre
| ||
2026.8.29.232711.dev0
pre
| ||
2026.8.27.231323.dev0
pre
| ||
2026.8.27.3630.dev0
pre
| ||
2026.8.25.233329.dev0
pre
| ||
2026.8.20.234504.dev0
pre
| ||
2026.8.19
minor
| ||
2026.8.19.233000.dev0
pre
| ||
2026.8.18.122307.dev0
pre
| ||
2026.8.17.73947.dev0
pre
| ||
2026.8.16.20253.dev0
pre
| ||
2026.8.4.234419.dev0
pre
| ||
2026.7.23.234303.dev0
pre
|
2026.7.23.234303.dev0
pre
Dependencies (23)
+ 15 more
Changelog
Compare changes
|
|
2026.7.21.234255.dev0
pre
| ||
2026.7.20.234742.dev0
pre
| ||
2026.7.14.233956.dev0
pre
| ||
2026.7.12.233956.dev0
pre
| ||
2026.7.9.234832.dev0
pre
| ||
2026.7.6.234510.dev0
pre
| ||
2026.7.4
minor
| ||
2026.7.4.221833.dev0
pre
| ||
2026.7.3.234421.dev0
pre
1 CVE
CVE-2026-55404
PYSEC-2026-3622
GHSA-6v4j-43gg-vj32
Aug 04, 2026
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
7.5
/ 10
High
Network
High
None
Required
Unchanged
High
High
High
SummaryIf the DetailsThe expected result of yt-dlp's There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files. Scenario 1:
| ||
2026.7.2.234458.dev0
pre
1 CVE
CVE-2026-55404
PYSEC-2026-3622
GHSA-6v4j-43gg-vj32
Aug 04, 2026
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
7.5
/ 10
High
Network
High
None
Required
Unchanged
High
High
High
SummaryIf the DetailsThe expected result of yt-dlp's There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files. Scenario 1:
| ||
2026.7.1.235203.dev0
pre
1 CVE
CVE-2026-55404
PYSEC-2026-3622
GHSA-6v4j-43gg-vj32
Aug 04, 2026
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
7.5
/ 10
High
Network
High
None
Required
Unchanged
High
High
High
SummaryIf the DetailsThe expected result of yt-dlp's There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files. Scenario 1:
| ||
2026.6.30.234726.dev0
pre
1 CVE
CVE-2026-55404
PYSEC-2026-3622
GHSA-6v4j-43gg-vj32
Aug 04, 2026
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
7.5
/ 10
High
Network
High
None
Required
Unchanged
High
High
High
SummaryIf the DetailsThe expected result of yt-dlp's There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files. Scenario 1:
| ||
2026.6.29.234344.dev0
pre
1 CVE
CVE-2026-55404
PYSEC-2026-3622
GHSA-6v4j-43gg-vj32
Aug 04, 2026
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
7.5
/ 10
High
Network
High
None
Required
Unchanged
High
High
High
SummaryIf the DetailsThe expected result of yt-dlp's There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files. Scenario 1:
| ||
2026.6.28.234618.dev0
pre
1 CVE
CVE-2026-55404
PYSEC-2026-3622
GHSA-6v4j-43gg-vj32
Aug 04, 2026
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
7.5
/ 10
High
Network
High
None
Required
Unchanged
High
High
High
SummaryIf the DetailsThe expected result of yt-dlp's There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files. Scenario 1:
| ||
2026.6.27.234340.dev0
pre
1 CVE
CVE-2026-55404
PYSEC-2026-3622
GHSA-6v4j-43gg-vj32
Aug 04, 2026
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
7.5
/ 10
High
Network
High
None
Required
Unchanged
High
High
High
SummaryIf the DetailsThe expected result of yt-dlp's There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files. Scenario 1:
| ||
2026.6.26.234622.dev0
pre
1 CVE
CVE-2026-55404
PYSEC-2026-3622
GHSA-6v4j-43gg-vj32
Aug 04, 2026
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
7.5
/ 10
High
Network
High
None
Required
Unchanged
High
High
High
SummaryIf the DetailsThe expected result of yt-dlp's There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files. Scenario 1:
| ||
2026.6.24.234707.dev0
pre
1 CVE
CVE-2026-55404
PYSEC-2026-3622
GHSA-6v4j-43gg-vj32
Aug 04, 2026
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
7.5
/ 10
High
Network
High
None
Required
Unchanged
High
High
High
SummaryIf the DetailsThe expected result of yt-dlp's There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files. Scenario 1:
| ||
2026.6.21.235142.dev0
pre
1 CVE
CVE-2026-55404
PYSEC-2026-3622
GHSA-6v4j-43gg-vj32
Aug 04, 2026
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
7.5
/ 10
High
Network
High
None
Required
Unchanged
High
High
High
SummaryIf the DetailsThe expected result of yt-dlp's There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files. Scenario 1:
| ||
2026.6.20.234736.dev0
pre
1 CVE
CVE-2026-55404
PYSEC-2026-3622
GHSA-6v4j-43gg-vj32
Aug 04, 2026
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
7.5
/ 10
High
Network
High
None
Required
Unchanged
High
High
High
SummaryIf the DetailsThe expected result of yt-dlp's There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files. Scenario 1:
| ||
2026.6.18.235958.dev0
pre
1 CVE
CVE-2026-55404
PYSEC-2026-3622
GHSA-6v4j-43gg-vj32
Aug 04, 2026
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
7.5
/ 10
High
Network
High
None
Required
Unchanged
High
High
High
SummaryIf the DetailsThe expected result of yt-dlp's There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files. Scenario 1:
| ||
2026.6.17.235412.dev0
pre
1 CVE
CVE-2026-55404
PYSEC-2026-3622
GHSA-6v4j-43gg-vj32
Aug 04, 2026
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
7.5
/ 10
High
Network
High
None
Required
Unchanged
High
High
High
SummaryIf the DetailsThe expected result of yt-dlp's There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files. Scenario 1:
| ||
2026.6.16.235352.dev0
pre
1 CVE
CVE-2026-55404
PYSEC-2026-3622
GHSA-6v4j-43gg-vj32
Aug 04, 2026
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
7.5
/ 10
High
Network
High
None
Required
Unchanged
High
High
High
SummaryIf the DetailsThe expected result of yt-dlp's There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files. Scenario 1:
| ||
2026.6.16.106.dev0
pre
1 CVE
CVE-2026-55404
PYSEC-2026-3622
GHSA-6v4j-43gg-vj32
Aug 04, 2026
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
7.5
/ 10
High
Network
High
None
Required
Unchanged
High
High
High
SummaryIf the DetailsThe expected result of yt-dlp's There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files. Scenario 1:
| ||
2026.6.13.234541.dev0
pre
1 CVE
CVE-2026-55404
PYSEC-2026-3622
GHSA-6v4j-43gg-vj32
Aug 04, 2026
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
7.5
/ 10
High
Network
High
None
Required
Unchanged
High
High
High
SummaryIf the DetailsThe expected result of yt-dlp's There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files. Scenario 1:
| ||
2026.6.12.235626.dev0
pre
1 CVE
CVE-2026-55404
PYSEC-2026-3622
GHSA-6v4j-43gg-vj32
Aug 04, 2026
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
7.5
/ 10
High
Network
High
None
Required
Unchanged
High
High
High
SummaryIf the DetailsThe expected result of yt-dlp's There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files. Scenario 1:
| ||
2026.6.11.235628.dev0
pre
1 CVE
CVE-2026-55404
PYSEC-2026-3622
GHSA-6v4j-43gg-vj32
Aug 04, 2026
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
7.5
/ 10
High
Network
High
None
Required
Unchanged
High
High
High
SummaryIf the DetailsThe expected result of yt-dlp's There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files. Scenario 1:
| ||
2026.6.10.235405.dev0
pre
1 CVE
CVE-2026-55404
PYSEC-2026-3622
GHSA-6v4j-43gg-vj32
Aug 04, 2026
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
7.5
/ 10
High
Network
High
None
Required
Unchanged
High
High
High
SummaryIf the DetailsThe expected result of yt-dlp's There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files. Scenario 1:
| ||
2026.6.9
minor
1 CVE
CVE-2026-55404
PYSEC-2026-3622
GHSA-6v4j-43gg-vj32
Aug 04, 2026
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
7.5
/ 10
High
Network
High
None
Required
Unchanged
High
High
High
SummaryIf the DetailsThe expected result of yt-dlp's There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files. Scenario 1:
|