CVE-2026-50574 is an injection flaw (CWE-74) in yt-dlp before version 2026.06.09, scored 8.3 high. When aria2c is the external downloader for HLS or DASH streams, input is passed on unsanitized and allows an arbitrary file write. Upgrade to 2026.06.09 or later.
What's affected
yt-dlp versions before 2026.06.09, installed from pip or any other source. The patched version is 2026.06.09.
Only runs that set aria2c as the external downloader for fragmented manifest formats such as HLS or DASH are involved. The default downloaders are not part of this issue, per the advisory.
How to check if you're exposed
Read your version:
yt-dlp --version
pip show yt-dlp
If it is lower than 2026.06.09, you are affected when aria2c is used. Check your command lines, shell aliases and the config file for the external downloader option:
grep -rn "aria2c" ~/.config/yt-dlp/ ~/.bashrc ~/.zshrc 2>/dev/null
Also look in scripts and CI jobs that call yt-dlp.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- Upgrade yt-dlp:
pip install -U yt-dlp, or update through the package manager you used. - Search scripts, services and config files that call yt-dlp for the aria2c downloader option.
- If you cannot upgrade yet, pass the downloader option
dash,m3u8:nativeon the command line, as the advisory suggests. - Do not run downloads from untrusted sources on shared or privileged accounts.
- Check for unexpected files in the places your user account can write, if you ran affected versions against untrusted streams.
Why it matters
yt-dlp builds an input file for aria2c from the fragment URLs it reads out of a manifest. That file format allows extra option lines after each URL, so insufficiently sanitized manifest data can add options, including ones that control where a file is written.
The advisory says that on Windows this can lead to immediate code execution, and on other platforms to code execution the next time yt-dlp runs. The weakness class is CWE-74, injection into a downstream component. The record does not flag the CVE as exploited in the wild and it is not in the CISA KEV catalog. The scoring notes that the user must start a download.
Quick check
Am I affected if I never set aria2c?
The advisory limits the flaw to runs that use aria2c as the external downloader for fragmented manifests.
What is the interim workaround?
The advisory suggests adding --downloader dash,m3u8:native to the command. Upgrading is still the proper fix.
Sources
Last reviewed: 19 October 2026.
