SUSE moodle-dl · Security update for yt-dlp
Affects SUSE moodle-dlSource GCVE Database
Mentioned vulnerabilities
Not known to be exploited : upgrade SUSE moodle-dl to 2.3.13_11 soon.
Data as of 31 Oct 2026, 20:20 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 24% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 2.3.13_11
Exploitation evidence
Disclosed: evidence found.
CVE published 29 Jun 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 31 Oct 2026.
What to do
Upgrade moodle-dl to 2.3.13_11.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Homebrewmoodle-dlpkg:brew/moodle-dlOther threats | Affected
| Fixed in
|
Ubuntu 22.04 LTSyt-dlppkg:deb/ubuntu/yt-dlp?arch=source&distro=jammyOther threats | Affected
| Fixed in– |
Ubuntu 24.04 LTSyt-dlppkg:deb/ubuntu/yt-dlp?arch=source&distro=nobleOther threats | Affected
| Fixed in– |
Ubuntu 25.10yt-dlppkg:deb/ubuntu/yt-dlp?arch=source&distro=questingOther threats | Affected
| Fixed in– |
Ubuntu 26.10yt-dlppkg:deb/ubuntu/yt-dlp?arch=source&distro=stonkingOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSyt-dlppkg:deb/ubuntu/yt-dlp?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
This update for yt-dlp fixes the following issues: Changes in yt-dlp: - Update to version 2026.06.09 * Fixed [CVE-2026-50019]: File Downloader cookie leak with curl * Fixed [CVE-2026-50023]: Dangerous file type creation via insufficient filename sanitization * Fixed [CVE-2026-50574]: Arbitrary code execution via manifest downloads with aria2c * Added lockfile and pinned extras * Removed url, desktop and webloc from safe extensions * Extract supplemental codecs from DASH manifests * abematv: Extract subtitles * ard: Support new ardsounds domain * monstercat: Support older URLs * pornhub: Support browser impersonation * reddit: Fix unauthenticated extraction * rtp: Support multi-part episodes and --no-playlist * s4c: Extract more metadata * soop: Adapt extractors to new domain * soundcloud: Support --extractor-retries for original formats * twitch: Remove dead rechat subtitles * twitter: Fix view_count extraction * external: aria2c: Remove support for m3u8/dash protocols * ffmpegmetadata: Avoid erroneous ISO 639 conversions
References
- suse.com/support/security/rating/ (opens in a new tab)
- ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21163-1.json (opens in a new tab)
- suse.com/security/cve/CVE-2026-50019/ (opens in a new tab)
- suse.com/security/cve/CVE-2026-50023/ (opens in a new tab)
- suse.com/security/cve/CVE-2026-50574/ (opens in a new tab)