CVE-2026-50019: yt-dlp is a command-line audio/video downloader

Routine

MEDIUM 6.1UPGRADE

CVE-2026-50019 is a medium-severity flaw (CVSS 6.1) affecting yt-dlp. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

yt-dlp is a command-line audio/video downloader. From 2023.09.24 until 2026.06.09, if curl is used as an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. At the file download stage, the cookies are passed by yt-dlp to the file downloader via --cookie. However, unless these are loaded from a file, this operation does not acti

Why this priority

No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score	6.1 (Medium)
Attack vector	Network (remote)
Attack complexity	High
Privileges needed	None
User interaction	Required
EPSS exploit chance	0.3% (top 75%)
CISA exploited list	No
Weakness	CWE-200
Published	2026-06-23
Last modified	2026-06-26

Publisher (CNA): GitHub, Inc. · Vendor: yt-dlp project

Last updated 2026-06-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-06-23 17:17 UTCPublished CVE record published
2026-06-26 20:12 UTCUpdated Record last modified

yt-dlp project yt-dlp UPGRADE

Affected: >= 2023.09.24 and < 2026.06.09

Fixed in: 2026.06.09

Safe to downgrade to: a release before 2023.09.24

1. Check installed version

apt-cache policy yt-dlp || rpm -q yt-dlp || yt-dlp --version

2. UPGRADE to 2026.06.09 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade yt-dlp

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade yt-dlp

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 2023.09.24 (Debian / Ubuntu)

apt-cache madison yt-dlp sudo apt install yt-dlp=<VERSION_BEFORE_2023.09.24> sudo apt-mark hold yt-dlp

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list yt-dlp sudo dnf downgrade yt-dlp-<VERSION_BEFORE_2023.09.24> sudo dnf versionlock add yt-dlp

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-50019?

yt-dlp: upgrade to 2026.06.09. Exact commands for each OS are on this page.

Is CVE-2026-50019 being exploited?

CVE-2026-50019 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-50019 affect?

CVE-2026-50019 affects yt-dlp. Severity is medium (CVSS 6.1). yt-dlp is a command-line audio/video downloader. From 2023.09.24 until 2026.06.09, if curl is used as an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments

How urgent is CVE-2026-50019?

Priority 28/100. No elevated risk signals yet.

Software pages

curl vulnerabilities

Related CVEs

CVE-2026-55404 HIGH 7.5 UPGRADE yt-dlp and youtube-dl are command-line audio/video downloaders
CVE-2026-50023 HIGH 8.3 UPGRADE yt-dlp is a command-line audio/video downloader
CVE-2026-50574 HIGH 8.3 UPGRADE yt-dlp is a command-line audio/video downloader

References

← Back to latest CVEs