MGASA-2026-0234: yt-dlp Mageia

Vulnerability summary

MGASA-2026-0234 is a vulnerability in yt-dlp Mageia with no CVSS score yet.

Timeline

1. 04-07-2026
   PublishedVulnerability first disclosed.
2. 04-07-2026
   Last modifiedVulnerability information updated.

Description

Updated yt-dlp packages fix security vulnerabilities CVE-2026-50019 If curl is used as an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. CVE-2026-50023 A vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519. CVE-2026-50574 If aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp. For mageia 9 we import yt-dlp-ejs to ensure the application still works.

No weakness data has been published for this record.