CVE-2026-50019 Details
Description
yt-dlp is a command-line audio/video downloader. From 2023.09.24 until 2026.06.09, if curl is used as an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. At the file download stage, the cookies are passed by yt-dlp to the file downloader via --cookie. However, unless these are loaded from a file, this operation does not activate the cookie engine. As a result, curl will send cookies with requests to domains or paths for which the cookies are not scoped. This vulnerability is fixed in 2026.06.09.
A vulnerability in yt-dlp, a command-line audio/video downloader, allows for cookie leakage to unintended hosts when curl is used as an external downloader. This issue affects yt-dlp versions 2023.09.24 prior to 2026.06.09. The vulnerability arises because cookies are passed to curl via the --cookie option, but this does not activate the cookie engine unless the cookies are loaded from a file. As a result, curl may send cookies to domains or paths where they are not intended to be scoped. The vulnerability can be exploited during HTTP redirects or when the host for download fragments differs from their parent manifest's.
Upgrade yt-dlp to version 2026.06.09 or later. For users unable to upgrade, do not use curl as the downloader.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-f7j3-774f-rfhj | [email protected] | MitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| yt-dlp project yt-dlp | >= 2023.09.24, < 2026.06.09 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |