CVE-2026-26331
📋 TL;DR
This vulnerability allows arbitrary command injection in yt-dlp when using the --netrc-cmd option with maliciously crafted URLs. Attackers can execute commands on the user's system by exploiting HTTP redirects from compromised websites. Only users who explicitly use --netrc-cmd or netrc_cmd parameters are affected.
💻 Affected Systems
- yt-dlp
📦 What is this software?
Yt Dlp by Yt Dlp Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the affected system, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Limited command execution in the context of the yt-dlp user, potentially leading to data exfiltration, cryptocurrency mining, or backdoor installation.
If Mitigated
No impact if --netrc-cmd is not used or proper input validation is implemented.
🎯 Exploit Status
Exploitation requires user interaction (visiting malicious site/URL) but no authentication. No evidence of active exploitation found.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2026.02.21
Vendor Advisory: https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-g3gw-q23r-pgqm
Restart Required: No
Instructions:
1. Update yt-dlp using pip: pip install --upgrade yt-dlp
2. Or download latest release from GitHub: https://github.com/yt-dlp/yt-dlp/releases/tag/2026.02.21
3. Verify version with: yt-dlp --version
🔧 Temporary Workarounds
Disable --netrc-cmd usage
allRemove --netrc-cmd from all command-line invocations and netrc_cmd from Python scripts
# Remove --netrc-cmd from any scripts or configurations
Avoid placeholder in --netrc-cmd
allIf --netrc-cmd must be used, ensure no placeholder ({}) is passed in the argument
# Example: yt-dlp --netrc-cmd 'custom_command' URL
🧯 If You Can't Patch
- Immediately stop using --netrc-cmd option in all configurations
- Implement network filtering to block suspicious URLs and redirects
🔍 How to Verify
Check if Vulnerable:
Check if yt-dlp version is between 2023.06.21 and 2026.02.20 AND --netrc-cmd is used in scripts/commandsCheck Version:
yt-dlp --versionVerify Fix Applied:
Verify yt-dlp version is 2026.02.21 or later: yt-dlp --version📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns from yt-dlp process
- Error logs containing netrc validation failures
Network Indicators:
- HTTP redirects to suspicious domains followed by yt-dlp execution
- Outbound connections to unexpected destinations after yt-dlp runs
SIEM Query:
process_name='yt-dlp' AND command_line LIKE '%--netrc-cmd%'