GHSA-g3gw-q23r-pgqm · Severity: high · Ecosystem: pip — yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter) is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously crafted URL. yt-dlp maintainers assume the impact of this vulnerability to be high for anyone who uses `--netrc-cmd` in their command/configuration or `netrc_cmd` in their Python scripts. Even though the maliciously crafted URL itself will look very suspicious to many users, it would be trivial for a maliciously crafted webpage with an inconspicuous URL to covertly exploit this vulnerability via HTTP redirect. Users without `--netrc-cmd` in their arguments or `netrc_cmd` in their scripts are unaffected. No evidence has been found of this exploit being used in the wild. yt-dlp version 2026.02.21 fixes this issue by validating all netrc "machine" values and raising an error upon unexpected input. As a workaround, users who are unable to upgrade should avoid using the `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter), or they should at least not pass a placeholder (`{}`) in their `--netrc-cmd` argument.
Conclusion & alert: CVE-2026-26331 is rated High Exploit Risk (63/100): CVSS High severity, with low exploitation likelihood (EPSS 0.17%). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-03-21 | 0.70% | 0.17% | -0.53% |
| 2 | 2026-03-02 | 0.60% | 0.70% | +0.10% |
| 3 | 2026-02-26 | — | 0.60% | — |
Full EPSS history (4 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 8.8 | 3.1 | HIGH |
|
2.8 | 5.9 | [email protected] |
GHSA-g3gw-q23r-pgqm · Severity: high · Ecosystem: pip — yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
| vendor | priority | summary | link |
|---|---|---|---|
alpine
|
— | CVE-2026-26331: 1 source package rows (yt-dlp); 42 state rows across 2 repos (3.23-community, edge-community); fixed 0, open 42. | https://security.alpinelinux.org/vuln/CVE-2026-26331 |
debian
|
unimportant | CVE-2026-26331 unimportant priority: Debian including 1 source packages (yt-dlp), 4 status rows across 4 suites (bookworm, forky, sid, trixie): resolved 3, open 1. | https://security-tracker.debian.org/tracker/CVE-2026-26331 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2026-26331 |
ubuntu
|
medium | CVE-2026-26331 medium priority: Ubuntu including 1 source packages (yt-dlp), 4 status rows across 4 suites (jammy, noble, questing, upstream): needs-triage 4. | https://ubuntu.com/security/CVE-2026-26331 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| yt-dlp_project | yt-dlp | >= 2023.06.21, < 2026.02.21 | cpe:2.3:a:yt-dlp_project:yt-dlp:*:*:*:*:*:*:*:* |
| URL | Tags |
|---|---|
| https://github.com/yt-dlp/yt-dlp/commit/1fbbe29b99dc61375bf6d786f824d9fcf6ea9c1a | Patch |
| https://github.com/yt-dlp/yt-dlp/releases/tag/2026.02.21 | Product Release Notes |
| https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-g3gw-q23r-pgqm | Exploit Mitigation Vendor Advisory |