Yewtube: yt-dlp has dependency on potentially malicious third-party code in Douyu extractors
yt-dlp versions from 2.10.5 up to but not including 2.10.5_7 included DouyuTV and DouyuShow extractors that fetched a component of the crypto-js JavaScript library from a third-party CDN (cdn.bootcdn.net) controlled by a known malicious actor. This JavaScript code was executed externally using PhantomJS, potentially exposing users to malicious code execution if certain conditions were met. The issue is fixed in yt-dlp version 2024.07.07 by removing the malicious CDN URL and invalidating cached data.
AI Analysis
Technical Summary
The yt-dlp tool's DouyuTV and DouyuShow extractors used a fallback URL from cdn.bootcdn.net to fetch a crypto-js JavaScript library component. This CDN is controlled by the actor behind the Polyfill JS supply chain attack. When using these extractors, yt-dlp extracts and executes the JavaScript code externally via PhantomJS. Exploitation requires PhantomJS installed, use of Douyu-related URLs, and unavailability or blocking of the primary CDN (cdnjs.cloudflare.com) causing fallback to the malicious CDN or cached malicious code. yt-dlp version 2024.07.07 removes the malicious CDN URL and clears cached data to mitigate this risk.
Potential Impact
Potential execution of malicious JavaScript code from a compromised third-party CDN when using yt-dlp's Douyu extractors with PhantomJS. There is no evidence of active exploitation or PhantomJS vulnerabilities related to this attack. The impact is limited to users meeting all specific conditions: having PhantomJS installed, using Douyu URLs, and the fallback CDN being used due to unavailability of the primary CDN.
Mitigation Recommendations
A fix is available in yt-dlp version 2024.07.07, which removes the malicious CDN URL and invalidates cached Douyu extractor data. Users should upgrade to this version as soon as possible. For those unable to upgrade, avoid using the Douyu extractors by disabling them with '--ies default,-douyutv,-douyushow' and uninstall or avoid installing PhantomJS.
Yewtube: yt-dlp has dependency on potentially malicious third-party code in Douyu extractors
Description
yt-dlp versions from 2.10.5 up to but not including 2.10.5_7 included DouyuTV and DouyuShow extractors that fetched a component of the crypto-js JavaScript library from a third-party CDN (cdn.bootcdn.net) controlled by a known malicious actor. This JavaScript code was executed externally using PhantomJS, potentially exposing users to malicious code execution if certain conditions were met. The issue is fixed in yt-dlp version 2024.07.07 by removing the malicious CDN URL and invalidating cached data.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The yt-dlp tool's DouyuTV and DouyuShow extractors used a fallback URL from cdn.bootcdn.net to fetch a crypto-js JavaScript library component. This CDN is controlled by the actor behind the Polyfill JS supply chain attack. When using these extractors, yt-dlp extracts and executes the JavaScript code externally via PhantomJS. Exploitation requires PhantomJS installed, use of Douyu-related URLs, and unavailability or blocking of the primary CDN (cdnjs.cloudflare.com) causing fallback to the malicious CDN or cached malicious code. yt-dlp version 2024.07.07 removes the malicious CDN URL and clears cached data to mitigate this risk.
Potential Impact
Potential execution of malicious JavaScript code from a compromised third-party CDN when using yt-dlp's Douyu extractors with PhantomJS. There is no evidence of active exploitation or PhantomJS vulnerabilities related to this attack. The impact is limited to users meeting all specific conditions: having PhantomJS installed, using Douyu URLs, and the fallback CDN being used due to unavailability of the primary CDN.
Mitigation Recommendations
A fix is available in yt-dlp version 2024.07.07, which removes the malicious CDN URL and invalidates cached Douyu extractor data. Users should upgrade to this version as soon as possible. For those unable to upgrade, avoid using the Douyu extractors by disabling them with '--ies default,-douyutv,-douyushow' and uninstall or avoid installing PhantomJS.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BREW-yewtube-GHSA-3v33-3wmw-3785
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Homebrew"]
Threat ID: 6aac8e6e55bf5e2cf5491ed1
Added to database: 09/18/2026, 01:05:50 UTC
Last enriched: 09/18/2026, 01:56:46 UTC
Last updated: 09/18/2026, 01:56:46 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.