Is yt-dlp affected by CVE-2026-50019?

PyPI yt-dlp is affected in >=2023.9.24 <2026.6.9.

Is CVE-2026-50019 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.3%.

medium

CVE-2026-50019

Q: Is CVE-2026-50019 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.3%.

PyPI · yt-dlp

Summary

yt-dlp: File Downloader cookie leak with curl

Severity: medium
EPSS: 0.3% (p25)
Also known as: GHSA-f7j3-774f-rfhj
Published: 2026-06-16

References

https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-f7j3-774f-rfhj
https://github.com/yt-dlp/yt-dlp/commit/2726572520238356bcf64aba2040228648b44c82
https://github.com/yt-dlp/yt-dlp

Related advisories

CVE-2026-55404 — high · PyPI/yt-dlp
GHSA-69qj-pvh9-c5wg — high · PyPI/yt-dlp
CVE-2026-50574 — high · PyPI/yt-dlp
CVE-2026-50023 — high · PyPI/yt-dlp
CVE-2026-26331 — high · PyPI/yt-dlp

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.