DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-26331: yt-dlp: Downloading Shells Instead of Videos via --netrc-cmd

#security #cve #cybersecurity

yt-dlp: Downloading Shells Instead of Videos via --netrc-cmd

Vulnerability ID: CVE-2026-26331
CVSS Score: 8.8
Published: 2026-02-23

A high-severity OS command injection vulnerability in yt-dlp allows attackers to execute arbitrary code via crafted URLs. By exploiting the --netrc-cmd feature and permissive hostname extraction logic, a malicious link can turn a video download into a full system compromise.

TL;DR

If you use yt-dlp with the --netrc-cmd option to handle credentials, you are vulnerable to RCE. Attackers can embed shell commands in URLs (e.g., subdomains) which get passed unsanitized to your system shell. Update to version 2026.02.21 immediately.

⚠️ Exploit Status: POC

Technical Details

  • CWE: CWE-78 (OS Command Injection)
  • CVSS: 8.8 (High)
  • Attack Vector: Network (via malicious URL)
  • Constraint: Requires --netrc-cmd usage
  • Exploit Status: Proof-of-Concept Available
  • Patch: Strict Alphanumeric Whitelist

Affected Systems

  • yt-dlp (Python)
  • Video downloading automation pipelines
  • Discord bots using yt-dlp
  • Web services wrapping yt-dlp
  • yt-dlp: >= 2023.06.21, < 2026.02.21 (Fixed in: 2026.02.21)

Code Analysis

Commit: 1fbbe29

Fix security vulnerability in --netrc-cmd

if netrc_machine.startswith(('-', '_')) or not all(c in ALLOWED for c in netrc_machine): raise ExtractorError...
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • GitHub: Proof of Concept demonstrating command injection via GetCourseRu extractor

Mitigation Strategies

  • Input Validation
  • Sink Hardening
  • Least Privilege

Remediation Steps:

  1. Run yt-dlp -U to update to version 2026.02.21 or later.
  2. Verify the version using yt-dlp --version.
  3. If updating is impossible, remove --netrc-cmd from all scripts and configuration files.
  4. Audit logs for past execution of suspicious URLs containing semicolons or shell operators.

References

Read the full report for CVE-2026-26331 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)