PT-2026-24643 · Mageia · Yt-Dlp

Published 2026-03-10 · Updated 2026-03-10

OSV

When yt-dlp's --netrc-cmd command-line option (or netrc cmd Python API parameter) is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously crafted URL.

Related Identifiers

MGASA-2026-0054

Affected Products

Yt-Dlp

References · 5

• https://osv.dev/vulnerability/MGASA-2026-0054 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2026-0054.html · Security Note
• https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-g3gw-q23r-pgqm · Note
• https://github.com/yt-dlp/yt-dlp/compare/2026.02.04...2026.03.03 · Note
• https://bugs.mageia.org/show_bug.cgi?id=35183 · Note