PT-2026-48378 · Undefined · Undefined

Published

2026-06-10

·

Updated

2026-06-10

·

CVE-2026-50019

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

Changelog

Important changes

  • The minimum supported versions of Deno, Node, and Bun have been raised. The minimum required version of Deno is now v2.3.0; supported Node versions are v22 and up; Bun support has been deprecated and limited to versions 1.2.11 through 1.3.14.
  • Security
    • Usage of vulnerable conversions (e.g. %()s) with the --exec option is an all-too-common pitfall. To remedy this, --exec now only allows safe conversions in its command templates.
      • Most users can simply replace %(...)s with %(...)q in their --exec argument(s). Numeric conversions are unaffected by this change. Using unsafe conversions with --exec poses a significant security risk. Read more
    • [CVE-2026-50019] File Downloader cookie leak with curl
      • Impact is limited to users of --downloader curl; cookies are now properly passed to curl so that it respects their scope
    • [CVE-2026-50023] Dangerous file type creation via insufficient filename sanitization
      • Writing files with the extensions .desktop, .url, or .webloc is now only allowed in the context of --write-link functionality
    • [CVE-2026-50574] Arbitrary code execution via manifest downloads with aria2c
      • Impact is limited to users of --downloader aria2c
      • Support for downloading HLS and DASH formats with aria2c has been removed. Users affected by this change should migrate to use -N for concurrent fragment downloads via the native downloader

Core changes

Extractor changes

Downloader changes

Postprocessor changes

Networking changes

Misc. changes

 
NOTE: The nightly release channel is strongly recommended for most users, as it gets all important fixes sooner.

To update to nightly from the executable/binary:

yt-dlp --update-to nightly

To install/upgrade to nightly with pip:

python3 -m pip install -U --pre "yt-dlp[default]"

To install nightly with pipx:

pipx uninstall yt-dlp pipx install --pip-args=--pre "yt-dlp[default]"

To upgrade to the latest nightly with pipx:

pipx upgrade --pip-args=--pre yt-dlp

To install from master with homebrew:

brew uninstall yt-dlp brew update && brew install --HEAD yt-dlp

To upgrade to latest master with homebrew if you've already installed with --HEAD:

brew upgrade --fetch-HEAD yt-dlp

Related Identifiers

CVE-2026-50019

Affected Products

Undefined