Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.4.0, Streamlink's HLS and DASH parsers do not validate the URI scheme of segment entries and other resources. A remote .m3u8 HLS playlist or .mpd DASH manifest can list file:///path/to/file as a segment, and streamlink will read that local file and write its contents to the output stream. This vulnerability is fixed in 8.4.0.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b9232006bb advisory.


    ## streamlink 8.4.0 (2026-05-06)

    - SECURITY: fixed arbitrary local file read via `file://` URI in HLS and DASH     ([`CVE-2026-44353`](https://nvd.nist.gov/vuln/detail/CVE-2026-44353) / [`GHSA-     hgqw-6m45-hw5f`](https://github.com/streamlink/streamlink/security/advisories/GHSA-hgqw-6m45-hw5f))
    - Added: `--stream-passthrough-encrypted` for passing through encrypted HLS/DASH segments to the output     stream without any checks ([#6896](https://github.com/streamlink/streamlink/pull/6896))
    - Fixed: `--interface` selection by name on macOS     ([#6908](https://github.com/streamlink/streamlink/pull/6908))
    - Fixed: `--interface` not being applied to adapters mounted after session init     ([#6915](https://github.com/streamlink/streamlink/pull/6915))
    - Updated plugins:
      - goltelevision: rewritten and fixed plugin     ([#6916](https://github.com/streamlink/streamlink/pull/6916))
      - twitcasting: improved ad segment filtering     ([#6910](https://github.com/streamlink/streamlink/pull/6910))

    [Full changelog](https://github.com/streamlink/streamlink/compare/8.3.0...8.4.0)


    ## streamlink 8.3.0 (2026-04-10)

    - Added: support for choosing the `--interface` by name on non-Windows systems, with optional prefixes,     similar to curl ([#6862](https://github.com/streamlink/streamlink/pull/6862))
    - Added: support for also checking stream segments in `HLSStream.parse_variant_playlist()` by setting     `check_streams=segments` ([#6878](https://github.com/streamlink/streamlink/pull/6878))
    - Fixed: stdout/stderr streams in `ProcessOutput` not being fully line-buffered     ([#6868](https://github.com/streamlink/streamlink/pull/6868))
    - Updated plugins:
      - cdnbg: rewritten and fixed plugin ([#6890](https://github.com/streamlink/streamlink/pull/6890))
      - nicolive: added websocket reconnect attempts on HLS decryption key retrieval failure     ([#6871](https://github.com/streamlink/streamlink/pull/6871))
      - soop: migrated to sooplive.com ([#6876](https://github.com/streamlink/streamlink/pull/6876))
      - telefe: rewritten and fixed plugin ([#6891](https://github.com/streamlink/streamlink/pull/6891))

    [Full changelog](https://github.com/streamlink/streamlink/compare/8.2.1...8.3.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4d6aae2d33 advisory.


    ## streamlink 8.4.0 (2026-05-06)

    - SECURITY: fixed arbitrary local file read via `file://` URI in HLS and DASH     ([`CVE-2026-44353`](https://nvd.nist.gov/vuln/detail/CVE-2026-44353) / [`GHSA-     hgqw-6m45-hw5f`](https://github.com/streamlink/streamlink/security/advisories/GHSA-hgqw-6m45-hw5f))
    - Added: `--stream-passthrough-encrypted` for passing through encrypted HLS/DASH segments to the output     stream without any checks ([#6896](https://github.com/streamlink/streamlink/pull/6896))
    - Fixed: `--interface` selection by name on macOS     ([#6908](https://github.com/streamlink/streamlink/pull/6908))
    - Fixed: `--interface` not being applied to adapters mounted after session init     ([#6915](https://github.com/streamlink/streamlink/pull/6915))
    - Updated plugins:
      - goltelevision: rewritten and fixed plugin     ([#6916](https://github.com/streamlink/streamlink/pull/6916))
      - twitcasting: improved ad segment filtering     ([#6910](https://github.com/streamlink/streamlink/pull/6910))

    [Full changelog](https://github.com/streamlink/streamlink/compare/8.3.0...8.4.0)


    ## streamlink 8.3.0 (2026-04-10)

    - Added: support for choosing the `--interface` by name on non-Windows systems, with optional prefixes,     similar to curl ([#6862](https://github.com/streamlink/streamlink/pull/6862))
    - Added: support for also checking stream segments in `HLSStream.parse_variant_playlist()` by setting     `check_streams=segments` ([#6878](https://github.com/streamlink/streamlink/pull/6878))
    - Fixed: stdout/stderr streams in `ProcessOutput` not being fully line-buffered     ([#6868](https://github.com/streamlink/streamlink/pull/6868))
    - Updated plugins:
      - cdnbg: rewritten and fixed plugin ([#6890](https://github.com/streamlink/streamlink/pull/6890))
      - nicolive: added websocket reconnect attempts on HLS decryption key retrieval failure     ([#6871](https://github.com/streamlink/streamlink/pull/6871))
      - soop: migrated to sooplive.com ([#6876](https://github.com/streamlink/streamlink/pull/6876))
      - telefe: rewritten and fixed plugin ([#6891](https://github.com/streamlink/streamlink/pull/6891))

    [Full changelog](https://github.com/streamlink/streamlink/compare/8.2.1...8.3.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to     8.4.0, Streamlink's HLS and DASH parsers do not validate the URI scheme of segment entries and other     resources. A remote .m3u8 HLS playlist or .mpd DASH manifest can list file:///path/to/file as a segment,     and streamlink will read that local file and write its contents to the output stream. This vulnerability     is fixed in 8.4.0. (CVE-2026-44353)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
325262	Fedora 44 : python-streamlink (2026-b9232006bb)	Nessus	Fedora Local Security Checks	medium
325135	Fedora 43 : python-streamlink (2026-4d6aae2d33)	Nessus	Fedora Local Security Checks	medium
313067	Linux Distros Unpatched Vulnerability : CVE-2026-44353	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-44353

medium

Tenable Plugins

medium

medium

medium