yt-dlp Generic Extractor MITM Vulnerability
Summary
CVE-2023-46121: yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection. Affects yt-dlp versions >= 2022.10.04, < 2023.11.14. Fixed in 2023.11.14. How to fix ↓
Also tracked for
- yt-dlp · Debian:12
The same CVE-2023-46121 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
yt-dlp is an open-source project that provides a command-line interface for downloading videos from various websites. It is built as an alternative to youtube-dl and offers additional features and improvements. The Generic Extractor in yt-dlp allows users to extract videos from websites that are not supported by specific extractors. However, this functionality is vulnerable to a MITM (Man-in-the-Middle) attack, where an attacker can set an arbitrary proxy for a request made by yt-dlp, potentially leading to cookie exfiltration and other malicious activities.
Vulnerability Detail
The vulnerability in the Generic Extractor of yt-dlp arises from the ability to smuggle HTTP headers in the URL. This feature was intended for internal use but can be exploited by a malicious website to set an arbitrary proxy for an arbitrary URL that yt-dlp requests. This allows an attacker to intercept and manipulate the request made by yt-dlp, potentially leading to cookie exfiltration or setting cookies for arbitrary sites. The impact of this vulnerability can vary depending on the security measures implemented by the target website, but it poses a significant risk to user privacy and security.
How To Fix
Latest published version: 2026.10.21.233146.dev0 as of 22 Oct 2026
pip install --upgrade "yt-dlp==2026.10.21.233146.dev0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2023.11.14
This is the first release that contains the fix.
pip install --upgrade "yt-dlp==2023.11.14"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, users can disable the Generic Extractor by using the command-line option --ies default,-generic. This will prevent yt-dlp from using the vulnerable extractor. Alternatively, users should exercise caution when using the --no-check-certificate option, as it can potentially expose them to MITM attacks.
Conclusion
The yt-dlp Generic Extractor MITM vulnerability allows an attacker to set an arbitrary proxy for requests made by yt-dlp, potentially leading to cookie exfiltration and other malicious activities. Users are advised to update to the latest version of yt-dlp (2023.11.14 or later) to mitigate this vulnerability. Alternatively, the Generic Extractor can be disabled or caution can be exercised when using certain command-line options. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for yt-dlp →
FAQ
yt-dlp is an open-source project that provides a command-line interface for downloading videos from various websites. It is a fork of youtube-dl and offers additional features and improvements.
The Generic Extractor is a component in yt-dlp that allows users to extract videos from websites that are not supported by specific extractors. It provides a fallback mechanism for handling unsupported sites.
The vulnerability allows a malicious website to include smuggled options in a URL, which are then extracted by the Generic Extractor. This enables the attacker to set an arbitrary proxy for an arbitrary URL that yt-dlp requests, potentially leading to a MITM attack and cookie exfiltration.
The consequences of this vulnerability include the ability for an attacker to intercept and manipulate requests made by yt-dlp, potentially leading to cookie exfiltration or setting cookies for arbitrary sites. However, the impact may vary depending on the security measures implemented by the target website.
To protect yourself from this vulnerability, it is recommended to update yt-dlp to version 2023.11.14 or later. Additionally, you can disable the Generic Extractor or only pass trusted sites with trusted content. Exercise caution when using the --no-check-certificate option.
References
Related vulnerabilities
Recent vulnerabilities recorded for yt-dlp.
