Threats tagged 'brew-scdl-cve-2026-50019'

A vulnerability in yt-dlp when using curl as an external downloader can cause cookie leakage to unintended hosts during HTTP redirects or when download fragment hosts differ from their parent manifest. This occurs because cookies passed via command line do not activate curl's cookie engine, causing cookies to be sent to domains outside their scope. The issue affects yt-dlp versions from 3.0.0 up to but not including 3.0.6. Version 3.0.6 includes a fix that changes how cookies are passed to curl, preventing leakage.