Yewtube: yt-dlp has dependency on potentially malicious third-party code in Douyu extractors
Affects yewtubeSource GCVE Database
Rated by Threat Radar
- Patch
- Available – fixed in 2.10.5_7
Data as of 18 Sep 2026, 01:56 UTC
What to do
Upgrade yewtube to 2.10.5_7.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Homebrewyewtubepkg:brew/yewtubeOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix is available in yt-dlp version 2024.07.07, which removes the malicious CDN URL and invalidates cached Douyu extractor data. Users should upgrade to this version as soon as possible. For those unable to upgrade, avoid using the Douyu extractors by disabling them with '--ies default,-douyutv,-douyushow' and uninstall or avoid installing PhantomJS.
Description
yt-dlp versions from 2.10.5 up to but not including 2.10.5_7 included DouyuTV and DouyuShow extractors that fetched a component of the crypto-js JavaScript library from a third-party CDN (cdn.bootcdn.net) controlled by a known malicious actor. This JavaScript code was executed externally using PhantomJS, potentially exposing users to malicious code execution if certain conditions were met. The issue is fixed in yt-dlp version 2024.07.07 by removing the malicious CDN URL and invalidating cached data.