Moodle dl: yt-dlp: Arbitrary code execution via manifest downloads with aria2c (CVE-2026-50574)
A vulnerability in yt-dlp when used with aria2c as an external downloader for fragmented manifest formats (HLS/DASH) allows attackers to inject arbitrary options into aria2c's input file. This can lead to arbitrary file writes and, on Windows, immediate arbitrary code execution. On other platforms, code execution can occur on subsequent yt-dlp invocations. The issue arises from insufficient sanitization of manifest data and metadata fields used in output templates. yt-dlp version 2026.06.09 removes support for aria2c with fragmented manifests to fix this issue.
AI Analysis
Technical Summary
yt-dlp uses aria2c's input file format to download fragmented manifests like HLS or DASH streams. The input file includes fragment URLs and optional aria2c command-line options. yt-dlp insufficiently sanitizes input, allowing attackers to inject newlines and arbitrary aria2c options via crafted DASH manifests or metadata fields when aria2c is used as the external downloader. This injection enables arbitrary file writes. On Windows, writing a malicious executable (e.g., ffmpeg.exe) in the current directory can lead to immediate code execution during postprocessing. On all platforms, writing a malicious yt-dlp.conf file can cause code execution on subsequent runs. yt-dlp 2026.06.09 fixes this by removing aria2c support for fragmented manifests.
Potential Impact
Successful exploitation allows attackers to perform arbitrary file writes on the victim's system. On Windows, this can lead to immediate arbitrary code execution by placing malicious executables in the working directory. On other platforms, attackers can achieve code execution on future yt-dlp invocations by writing malicious configuration files. This elevates the risk to high severity due to potential full system compromise.
Mitigation Recommendations
A fix is available in yt-dlp version 2026.06.09, which removes support for downloading fragmented manifest formats with aria2c. Users should upgrade to this version as soon as possible. For users unable to upgrade immediately, adding the option '--downloader dash,m3u8:native' to yt-dlp commands avoids using aria2c for these formats and mitigates the vulnerability.
Moodle dl: yt-dlp: Arbitrary code execution via manifest downloads with aria2c (CVE-2026-50574)
Description
A vulnerability in yt-dlp when used with aria2c as an external downloader for fragmented manifest formats (HLS/DASH) allows attackers to inject arbitrary options into aria2c's input file. This can lead to arbitrary file writes and, on Windows, immediate arbitrary code execution. On other platforms, code execution can occur on subsequent yt-dlp invocations. The issue arises from insufficient sanitization of manifest data and metadata fields used in output templates. yt-dlp version 2026.06.09 removes support for aria2c with fragmented manifests to fix this issue.
CVSS v3.1
Score 8.3high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
yt-dlp uses aria2c's input file format to download fragmented manifests like HLS or DASH streams. The input file includes fragment URLs and optional aria2c command-line options. yt-dlp insufficiently sanitizes input, allowing attackers to inject newlines and arbitrary aria2c options via crafted DASH manifests or metadata fields when aria2c is used as the external downloader. This injection enables arbitrary file writes. On Windows, writing a malicious executable (e.g., ffmpeg.exe) in the current directory can lead to immediate code execution during postprocessing. On all platforms, writing a malicious yt-dlp.conf file can cause code execution on subsequent runs. yt-dlp 2026.06.09 fixes this by removing aria2c support for fragmented manifests.
Potential Impact
Successful exploitation allows attackers to perform arbitrary file writes on the victim's system. On Windows, this can lead to immediate arbitrary code execution by placing malicious executables in the working directory. On other platforms, attackers can achieve code execution on future yt-dlp invocations by writing malicious configuration files. This elevates the risk to high severity due to potential full system compromise.
Mitigation Recommendations
A fix is available in yt-dlp version 2026.06.09, which removes support for downloading fragmented manifest formats with aria2c. Users should upgrade to this version as soon as possible. For users unable to upgrade immediately, adding the option '--downloader dash,m3u8:native' to yt-dlp commands avoids using aria2c for these formats and mitigates the vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-moodle-dl-CVE-2026-50574
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
- Cvss Version
- 3.1
Threat ID: 6aac8e6655bf5e2cf5491e7c
Added to database: 09/18/2026, 01:05:42 UTC
Last enriched: 09/18/2026, 01:56:51 UTC
Last updated: 09/18/2026, 02:06:44 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.