CVE-2026-26331
Description
A flaw was found in yt-dlp, a command-line audio/video downloader. When the --netrc-cmd command-line option is enabled, a remote attacker can exploit a maliciously crafted URL to achieve arbitrary command injection. This allows the attacker to execute unauthorized commands on the user's system, potentially leading to a complete compromise. This vulnerability primarily affects users who utilize the --netrc-cmd feature.
Statement
This is an IMPORTANT arbitrary command injection flaw in yt-dlp. The vulnerability occurs when the --netrc-cmd command-line option or netrc_cmd Python API parameter is actively used. Systems where this specific feature is not enabled or utilized are not affected by this issue.
Mitigation
To mitigate this issue, avoid using the `--netrc-cmd` command-line option or the `netrc_cmd` Python API parameter. If the `--netrc-cmd` option is essential for your workflow, ensure that a placeholder (`{}`) is not passed in the argument. Disabling this feature may impact workflows that rely on custom netrc command execution.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
