Streamlink versions prior to 8.5.0 contain a vulnerability in their HLS and DASH parsers that allows arbitrary local file reading via file:// URIs. This occurs because the parsers do not validate the URI scheme of segment entries, enabling a remote playlist or manifest to specify local file paths that Streamlink will read and output. The issue is fixed in version 8.5.0.