Arbitrary File Write in yt-dlp via aria2c

Executive Summary

The CVE-2026-50574 vulnerability in yt-dlp occurs when yt-dlp uses aria2c as an external downloader for fragmented manifest formats like HLS or DASH streams. yt-dlp passes insufficiently sanitized input to aria2c, which allows an attacker to inject malicious options into aria2c's input file.

On Windows platforms, this can lead to immediate arbitrary code execution by writing a malicious executable (such as ffmpeg.exe) to the current directory. On non-Windows platforms, it can lead to arbitrary code execution upon the next invocation of yt-dlp by writing a malicious configuration file (yt-dlp.conf) containing harmful arguments.

This vulnerability is fixed in yt-dlp version 2026.06.09 by removing support for downloading fragmented manifests with aria2c.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the CVE-2026-50574 vulnerability in yt-dlp affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary code on your system if you use yt-dlp with aria2c for downloading fragmented manifests.

• On Windows, immediate arbitrary code execution can occur, potentially allowing an attacker to run malicious programs with your user privileges.
• On other platforms, arbitrary code execution can happen the next time yt-dlp is run, which could lead to unauthorized actions or compromise of your system.

The attack requires user interaction but no special privileges, and the overall severity is high (CVSS score 8.3).

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves checking if yt-dlp is used with aria2c as an external downloader for fragmented manifest formats such as HLS or DASH streams.

You can verify the yt-dlp version installed on your system to see if it is prior to 2026.06.09, which is vulnerable.

• Run the command: yt-dlp --version

Additionally, inspect if yt-dlp is configured to use aria2c as the external downloader.

• Check yt-dlp configuration or command-line usage for the --external-downloader aria2c option.

On Windows, look for suspicious files like ffmpeg.exe in the current directory created by yt-dlp, which may indicate exploitation.

On non-Windows platforms, check for malicious yt-dlp.conf files containing harmful --exec arguments.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade yt-dlp to version 2026.06.09 or later, where the vulnerability is fixed.

If upgrading immediately is not possible, use the workaround by avoiding aria2c for fragmented manifests and instead use the native downloader.

• Run yt-dlp with the option: --downloader dash,m3u8:native

Avoid using aria2c as an external downloader for fragmented manifest formats until the update is applied.

Also, monitor and remove any suspicious files such as malicious executables or configuration files created by yt-dlp.

Useful 0 Not Useful 0