Threats tagged 'brew-scdl-cve-2026-50574'

A vulnerability in yt-dlp versions >=3.0.0 <3.0.6 allows arbitrary code execution via crafted manifest downloads when using aria2c as an external downloader. The flaw arises from insufficient sanitization of input passed to aria2c's input file, enabling attackers to inject arbitrary aria2c options and perform arbitrary file writes. On Windows, this can lead to immediate code execution; on other platforms, code execution can occur on subsequent yt-dlp runs. The issue is fixed in yt-dlp version 3.0.6.