GCVE-110-MAGEIA-2026-54

Advisory Published

Vulnetix · Advisory published March 10, 2026

When yt-dlp's --netrc-cmd command-line option (or netrc_cmd Python API parameter) is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously crafted URL.

Download JSON Open in Console

Affected Products

Vendor	Product	Versions	Platforms
Mageia	yt-dlp	2026.03.03-1.1.mga9 (unaffected), 0 (affected)	—

Aliases

CVE-2026-26331

References

Updated yt-dlp packages fix security vulnerability

advisory

Updated yt-dlp packages fix security vulnerability

issue

Updated yt-dlp packages fix security vulnerability

issue

Updated yt-dlp packages fix security vulnerability

issue

Browse GCVE Records

73,738 records in the GCVE database · Updated July 19, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON