CVE-2026-50574: yt-dlp RCE Vulnerability

CVE-2026-50574 Overview

CVE-2026-50574 is a high-severity argument injection vulnerability in yt-dlp, the widely used command-line audio and video downloader. The flaw exists in versions prior to 2026.06.09 when aria2c is configured as the external downloader for fragmented manifest formats such as HTTP Live Streaming (HLS) or Dynamic Adaptive Streaming over HTTP (DASH). yt-dlp passes insufficiently sanitized input to aria2c, enabling an attacker who controls a manifest to perform an arbitrary file write on the host. The issue is categorized under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Arbitrary file write leading to immediate arbitrary code execution on Windows, and code execution on the next yt-dlp invocation on non-Windows platforms.

Affected Products

yt-dlp versions prior to 2026.06.09
Deployments using aria2c as the --external-downloader for HLS or DASH streams
Any platform invoking yt-dlp against attacker-controlled manifests (Windows, Linux, macOS)

Discovery Timeline

2026-06-23 - CVE-2026-50574 published to the National Vulnerability Database (NVD)
2026-06-25 - Last updated in NVD database
Fix released - yt-dlp version 2026.06.09 addresses the vulnerability

Technical Details for CVE-2026-50574

Vulnerability Analysis

The vulnerability stems from improper sanitization of fragment URLs and parameters when yt-dlp delegates download work to the aria2c external downloader. When processing a fragmented manifest such as HLS (.m3u8) or DASH (.mpd), yt-dlp constructs the argument list passed to aria2c without neutralizing characters that aria2c interprets as control directives.

An attacker crafts a malicious manifest whose fragment entries contain injected aria2c options. These options direct aria2c to write attacker-supplied content to an arbitrary path on disk. On Windows, the attacker can drop an executable into a startup location or replace a binary in a writable directory that resides on the user's PATH, achieving immediate arbitrary code execution.

On Linux and macOS, the attacker writes to yt-dlp's plugin or configuration paths. Code executes the next time the user invokes yt-dlp. Exploitation requires user interaction, since the victim must run yt-dlp against the attacker's URL with aria2c configured as the external downloader.

Root Cause

The root cause is the absence of an argument boundary between yt-dlp-controlled flags and attacker-controlled fragment metadata. aria2c accepts options inline alongside URIs, so any unsanitized URI field becomes a vector for option injection. See the yt-dlp GitHub Security Advisory GHSA-vx4q-3cr2-7cg2 for technical details.

Attack Vector

The attack vector is network-based and requires user interaction. A victim must request a download from an attacker-influenced URL while using --external-downloader aria2c. Common scenarios include shared playlist links, embedded media in compromised sites, or automation pipelines that ingest user-submitted URLs.

No proof-of-concept code is published in the enriched data. Refer to the official security advisory for sanitized reproduction details.

Detection Methods for CVE-2026-50574

Indicators of Compromise

Unexpected file writes performed by aria2c.exe or aria2c processes to directories such as %APPDATA%, %USERPROFILE%\Start Menu, ~/.config/yt-dlp/, or ~/.local/bin/.
yt-dlp process trees spawning aria2c with arguments containing suspicious --out, --dir, or --conf-path values referencing system or user startup locations.
New or modified yt-dlp plugin files (yt_dlp_plugins/) appearing immediately after a download session.

Detection Strategies

Hunt for command lines where aria2c is invoked with options that resolve outside the expected yt-dlp temporary download directory.
Alert on yt-dlp child processes writing executable file types (.exe, .dll, .lnk, .py, .sh) to user-writable autorun paths.
Correlate HLS or DASH manifest fetches with subsequent file-write events outside the intended output directory.

Monitoring Recommendations

Inventory hosts running yt-dlp and capture installed versions to identify systems below 2026.06.09.
Log full command lines for yt-dlp and aria2c invocations and forward them to a centralized analytics tier for retrospective hunting.
Monitor for outbound requests to untrusted streaming endpoints from servers or build agents that process user-submitted URLs.

How to Mitigate CVE-2026-50574

Immediate Actions Required

Upgrade yt-dlp to version 2026.06.09 or later on all endpoints, servers, build agents, and container images.
Audit automation, scrapers, and media pipelines that pass user-supplied URLs to yt-dlp and verify the version in use.
Restrict yt-dlp execution to non-privileged accounts and isolate it from sensitive file system locations.

Patch Information

The vulnerability is fixed in yt-dlp 2026.06.09. The patch sanitizes input passed to aria2c so that fragment URLs and parameters can no longer be interpreted as command-line options. Refer to the yt-dlp GitHub Security Advisory for the full fix description and commit references.

Workarounds

Stop using aria2c as the external downloader until patching is complete. Remove --external-downloader aria2c from configurations and scripts.
Avoid downloading fragmented HLS or DASH content from untrusted sources while running unpatched yt-dlp versions.
Run yt-dlp inside a sandbox, container, or unprivileged user account with no write access to startup or plugin directories.

bash

# Upgrade yt-dlp to the patched release
python3 -m pip install --upgrade "yt-dlp>=2026.06.09"

# Verify the installed version
yt-dlp --version

# Temporary workaround: disable aria2c as the external downloader
# Remove or comment out lines like the following from yt-dlp config files
# --external-downloader aria2c
# --external-downloader-args "aria2c:..."