CVE-2026-92164: Streamlink Vulnerability Allows HTTP Redirects to Local Files

Background

Streamlink is an open-source command-line utility that allows users to stream video content from various services. It provides a unified interface for accessing streams and supports multiple protocols. However, a vulnerability in its HTTPSession component allows for HTTP redirects to local file URLs, potentially exposing sensitive local files to remote attackers.

Vulnerability Detail

The vulnerability arises from the HTTPSession class, which mounts a FileAdapter for the file:// scheme and inherits redirect handling from the requests.Session. This implementation does not validate scheme downgrades or cross-protocol transitions when following redirects. Consequently, an attacker can control a URL that Streamlink accesses, redirecting it to a file:// URL, which can lead to the exposure of local files. This flaw affects all requests made by the session, not just those related to streaming segments or manifests, thereby broadening the attack surface.

pip install --upgrade "streamlink==8.6.0"

Workaround

As a temporary workaround, you can implement a custom session that overrides the get_redirect_target() or resolve_redirects() methods to reject redirects to any scheme that is not the same as the request's scheme or a permitted upgrade. Here is an example code snippet:

from streamlink.session.http import HTTPSession

class CustomHTTPSession(HTTPSession):
    def get_redirect_target(self, response):
        target = super().get_redirect_target(response)
        if target and target.scheme not in ['http', 'https']:
            raise ValueError('Redirect to unsafe scheme')
        return target

s = CustomHTTPSession()

Conclusion

The CVE-2026-92164 vulnerability in Streamlink poses a significant risk by allowing HTTP redirects to local file URLs. Users are advised to update to version 8.6.0 or later to mitigate this risk. Implementing a custom session can serve as a temporary workaround while awaiting the update.

See every vulnerability recorded for streamlink →

FAQ