Advisories » MGASA-2026-0054

Updated yt-dlp packages fix security vulnerability

Publication date: 10 Mar 2026
Modification date: 10 Mar 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-26331

Description

When yt-dlp's --netrc-cmd command-line option (or netrc_cmd Python API
parameter) is used, an attacker could achieve arbitrary command
injection on the user's system with a maliciously crafted URL.
                

References

• https://bugs.mageia.org/show_bug.cgi?id=35183
• https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-g3gw-q23r-pgqm
• https://github.com/yt-dlp/yt-dlp/compare/2026.02.04...2026.03.03
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26331

SRPMS

9/core

• yt-dlp-2026.03.03-1.1.mga9