GHSA-g3gw-q23r-pgqm · 嚴重度： high · 生態： pip — yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter) is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously crafted URL. yt-dlp maintainers assume the impact of this vulnerability to be high for anyone who uses `--netrc-cmd` in their command/configuration or `netrc_cmd` in their Python scripts. Even though the maliciously crafted URL itself will look very suspicious to many users, it would be trivial for a maliciously crafted webpage with an inconspicuous URL to covertly exploit this vulnerability via HTTP redirect. Users without `--netrc-cmd` in their arguments or `netrc_cmd` in their scripts are unaffected. No evidence has been found of this exploit being used in the wild. yt-dlp version 2026.02.21 fixes this issue by validating all netrc "machine" values and raising an error upon unexpected input. As a workaround, users who are unable to upgrade should avoid using the `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter), or they should at least not pass a placeholder (`{}`) in their `--netrc-cmd` argument.
結論預警: CVE-2026-26331 綜合評估為高可利用風險（77/100）：CVSS 技術影響為高級，利用機率（EPSS 1.60%） 核心證據: 已收錄 1 筆公開利用參考（Exploit-DB）。 近一日 EPSS 上升 +1.43%，被利用關注度持續升高。 強制指令: 存在公開利用—請盤點暴露面、落實緩解措施並優先修補。
風險隨態勢動態變化；本站持續評估並同步更新本頁展示內容。
| EDB-ID | 來源 | 類型 | 公開時間 | 連結 |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS 日更估計相對被利用可能性；百分位表示該 CVE 在已評分漏洞中的相對排名（越高表示相對更嚴重）。
| # | 日期 | 舊 EPSS 分數 | 新 EPSS 分數 | 變化（新 − 舊） |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.17% | 1.60% | +1.43% |
| 2 | 2026-03-21 | 0.70% | 0.17% | -0.53% |
| 3 | 2026-03-02 | — | 0.70% | — |
完整 EPSS 歷史 （共 5 筆）
該 CVE 的 CVSS 指標。
| 底座分 | 版本 | 嚴重度 | 向量 | 可利用性 | 影響 | 分數來源 |
|---|---|---|---|---|---|---|
| 8.8 | 3.1 | HIGH |
|
2.8 | 5.9 | [email protected] |
GHSA-g3gw-q23r-pgqm · 嚴重度： high · 生態： pip — yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
| vendor | priority | summary | link |
|---|---|---|---|
alpine
|
— | CVE-2026-26331: 1 source package rows (yt-dlp); 42 state rows across 2 repos (3.23-community, edge-community); fixed 0, open 42. | https://security.alpinelinux.org/vuln/CVE-2026-26331 |
debian
|
unimportant | CVE-2026-26331 unimportant priority: Debian including 1 source packages (yt-dlp), 4 status rows across 4 suites (bookworm, forky, sid, trixie): resolved 3, open 1. | https://security-tracker.debian.org/tracker/CVE-2026-26331 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2026-26331 |
ubuntu
|
medium | CVE-2026-26331 medium priority: Ubuntu including 1 source packages (yt-dlp), 4 status rows across 4 suites (jammy, noble, questing, upstream): needs-triage 4. | https://ubuntu.com/security/CVE-2026-26331 |
| 廠商 | 產品 | 版本 | 原始 CPE |
|---|---|---|---|
| yt-dlp_project | yt-dlp | >= 2023.06.21, < 2026.02.21 | cpe:2.3:a:yt-dlp_project:yt-dlp:*:*:*:*:*:*:*:* |
| URL | 標籤 |
|---|---|
| https://github.com/yt-dlp/yt-dlp/commit/1fbbe29b99dc61375bf6d786f824d9fcf6ea9c1a | Patch |
| https://github.com/yt-dlp/yt-dlp/releases/tag/2026.02.21 | Product Release Notes |
| https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-g3gw-q23r-pgqm | Exploit Mitigation Vendor Advisory |