https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 05:51:49 +0000 https://db.gcve.eu/vuln/cve-2026-50019 <p><strong>Affected:</strong> yt-dlp</p> <p>yt-dlp is a command-line audio/video downloader. From 2023.09.24 until 2026.06.09, if curl is used as an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest&#39;s. At the file download stage, the cookies are passed by yt-dlp to the file downloader via --cookie. However, unless these are loaded from a file, this operation does not activate the cookie engine. As a result, curl will send cookies with requests to domains or paths for which the cookies are not scoped. This vulnerability is fixed in 2026.06.09.</p> <p><strong>Affected:</strong> yt-dlp</p> <p>yt-dlp is a command-line audio/video downloader. From 2023.09.24 until 2026.06.09, if curl is used as an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest&#39;s. At the file download stage, the cookies are passed by yt-dlp to the file downloader via --cookie. However, unless these are loaded from a file, this operation does not activate the cookie engine. As a result, curl will send cookies with requests to domains or paths for which the cookies are not scoped. This vulnerability is fixed in 2026.06.09.</p> https://db.gcve.eu/vuln/cve-2026-50019 https://db.gcve.eu/vuln/ghsa-f7j3-774f-rfhj <p><strong>Affected:</strong> PyPI: yt-dlp</p> <p>### Summary If curl is used an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest&#39;s.</p> <p>This is the equivalent to [GHSA-v8mc-9377-rwjj](&lt;https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-v8mc-9377-rwjj&gt;) for the `curl` downloader. The vulnerable behavior is present in [yt-dlp](https://github.com/yt-dlp/yt-dlp) released since 2023.09.24.</p> <p>### Details At the file download stage, the cookies are passed by yt-dlp to the file downloader via `--cookie`. However, unless these are loaded from a file, this operation does not activate the cookie engine. As a result, `curl` will send cookies with requests to domains or paths for which the cookies are not scoped.</p> <p>An example of a potential attack scenario exploiting this vulnerability: 1. an attacker has crafted a malicious website with an embedded URL designed to be detected by yt-dlp as a video download. This embedded URL has the domain of a trusted site that the user has loaded cookies for, and conducts an [unvalidated redirect](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html) to a target URL. 2. yt-dlp extracts this URL and calculates the cookies which are then passed to `curl`. 3. the download URL redirects to a server controlled by the attacker, to which `curl` forwards the user&#39;s sensitive cookie information.</p> <p>### Patches yt-dlp version 2026.06.09 fixes thi…</p> <p><strong>Affected:</strong> PyPI: yt-dlp</p> <p>### Summary If curl is used an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest&#39;s.</p> <p>This is the equivalent to [GHSA-v8mc-9377-rwjj](&lt;https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-v8mc-9377-rwjj&gt;) for the `curl` downloader. The vulnerable behavior is present in [yt-dlp](https://github.com/yt-dlp/yt-dlp) released since 2023.09.24.</p> <p>### Details At the file download stage, the cookies are passed by yt-dlp to the file downloader via `--cookie`. However, unless these are loaded from a file, this operation does not activate the cookie engine. As a result, `curl` will send cookies with requests to domains or paths for which the cookies are not scoped.</p> <p>An example of a potential attack scenario exploiting this vulnerability: 1. an attacker has crafted a malicious website with an embedded URL designed to be detected by yt-dlp as a video download. This embedded URL has the domain of a trusted site that the user has loaded cookies for, and conducts an [unvalidated redirect](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html) to a target URL. 2. yt-dlp extracts this URL and calculates the cookies which are then passed to `curl`. 3. the download URL redirects to a server controlled by the attacker, to which `curl` forwards the user&#39;s sensitive cookie information.</p> <p>### Patches yt-dlp version 2026.06.09 fixes thi…</p> https://db.gcve.eu/vuln/ghsa-f7j3-774f-rfhj https://db.gcve.eu/vuln/pysec-2026-3431 <p><strong>Affected:</strong> PyPI: yt-dlp</p> <p>### Summary If curl is used an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest&#39;s.</p> <p>This is the equivalent to [GHSA-v8mc-9377-rwjj](&lt;https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-v8mc-9377-rwjj&gt;) for the `curl` downloader. The vulnerable behavior is present in [yt-dlp](https://github.com/yt-dlp/yt-dlp) released since 2023.09.24.</p> <p>### Details At the file download stage, the cookies are passed by yt-dlp to the file downloader via `--cookie`. However, unless these are loaded from a file, this operation does not activate the cookie engine. As a result, `curl` will send cookies with requests to domains or paths for which the cookies are not scoped.</p> <p>An example of a potential attack scenario exploiting this vulnerability: 1. an attacker has crafted a malicious website with an embedded URL designed to be detected by yt-dlp as a video download. This embedded URL has the domain of a trusted site that the user has loaded cookies for, and conducts an [unvalidated redirect](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html) to a target URL. 2. yt-dlp extracts this URL and calculates the cookies which are then passed to `curl`. 3. the download URL redirects to a server controlled by the attacker, to which `curl` forwards the user&#39;s sensitive cookie information.</p> <p>### Patches yt-dlp version 2026.06.09 fixes thi…</p> <p><strong>Affected:</strong> PyPI: yt-dlp</p> <p>### Summary If curl is used an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest&#39;s.</p> <p>This is the equivalent to [GHSA-v8mc-9377-rwjj](&lt;https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-v8mc-9377-rwjj&gt;) for the `curl` downloader. The vulnerable behavior is present in [yt-dlp](https://github.com/yt-dlp/yt-dlp) released since 2023.09.24.</p> <p>### Details At the file download stage, the cookies are passed by yt-dlp to the file downloader via `--cookie`. However, unless these are loaded from a file, this operation does not activate the cookie engine. As a result, `curl` will send cookies with requests to domains or paths for which the cookies are not scoped.</p> <p>An example of a potential attack scenario exploiting this vulnerability: 1. an attacker has crafted a malicious website with an embedded URL designed to be detected by yt-dlp as a video download. This embedded URL has the domain of a trusted site that the user has loaded cookies for, and conducts an [unvalidated redirect](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html) to a target URL. 2. yt-dlp extracts this URL and calculates the cookies which are then passed to `curl`. 3. the download URL redirects to a server controlled by the attacker, to which `curl` forwards the user&#39;s sensitive cookie information.</p> <p>### Patches yt-dlp version 2026.06.09 fixes thi…</p> https://db.gcve.eu/vuln/pysec-2026-3431