CVE-2026-26331: yt-dlp Arbitrary Command Injection via --netrc-cmd Option
Summary
CVE-2026-26331: yt-dlp: Arbitrary Command Injection when using the --netrc-cmd option. Affects yt-dlp versions >= 2023.06.21, < 2026.02.21. Fixed in 2026.02.21. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
yt-dlp is a popular command-line tool for downloading videos from various websites. It is a fork of youtube-dl and offers additional features and improvements. One of its functionalities includes the ability to retrieve site login credentials securely using the --netrc-cmd option, which allows users to execute a shell command to obtain credentials without storing them in plaintext. However, this feature can be exploited if not used carefully, leading to potential command injection vulnerabilities.
Vulnerability Detail
The vulnerability arises from the use of the --netrc-cmd command-line option or the netrc_cmd Python API parameter in yt-dlp. When these options are used, an attacker can craft a malicious URL that, when processed, allows for arbitrary command execution on the user's system. This is particularly dangerous as the command is executed with shell=True, meaning that special characters in the command can be interpreted by the shell, leading to command injection. The impact is significant for users who utilize these options, as it could lead to unauthorized access or control over their systems.
How To Fix
Latest published version: 2026.10.21.233146.dev0 as of 22 Oct 2026
pip install --upgrade "yt-dlp==2026.10.21.233146.dev0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.02.21
This is the first release that contains the fix.
pip install --upgrade "yt-dlp==2026.02.21"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not possible, users should avoid using the --netrc-cmd command-line option or the netrc_cmd parameter in their scripts. If they must use it, they should refrain from passing a placeholder ({}) in their --netrc-cmd argument.
Conclusion
The vulnerability identified as CVE-2026-26331 in yt-dlp poses a significant risk due to arbitrary command injection via the --netrc-cmd option. Users are strongly advised to upgrade to the patched version to mitigate this risk. Awareness of this vulnerability and its implications is crucial for maintaining system security.
See every vulnerability recorded for yt-dlp →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The --netrc-cmd option allows users to execute a shell command to retrieve site login credentials dynamically, enhancing security by avoiding plaintext storage.
As of now, there is no evidence that this exploit has been actively used in the wild, but the potential for abuse exists.
If you cannot upgrade yt-dlp, avoid using the --netrc-cmd option or ensure that you do not pass a placeholder in your command.
References
Related vulnerabilities
Recent vulnerabilities recorded for yt-dlp.
