yt-dlp is a command-line audio/video downloader. From 2023.09.24 until 2026.06.09, if curl is used as an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. At the file download stage, the cookies are passed by yt-dlp to the file downloader via --cookie. However, unless these are loaded from a file, this operation does not activate the cookie engine. As a result, curl will send cookies with requests to domains or paths for which the cookies are not scoped. This vulnerability is fixed in 2026.06.09.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21163-1 advisory.

    Changes in yt-dlp:

    - Update to version 2026.06.09
      * Fixed [CVE-2026-50019]: File Downloader cookie leak with curl
      * Fixed [CVE-2026-50023]: Dangerous file type creation via         insufficient filename sanitization
      * Fixed [CVE-2026-50574]: Arbitrary code execution via manifest         downloads with aria2c
      * Added lockfile and pinned extras
      * Removed url, desktop and webloc from safe extensions
      * Extract supplemental codecs from DASH manifests
      * abematv: Extract subtitles
      * ard: Support new ardsounds domain
      * monstercat: Support older URLs
      * pornhub: Support browser impersonation
      * reddit: Fix unauthenticated extraction
      * rtp: Support multi-part episodes and --no-playlist
      * s4c: Extract more metadata
      * soop: Adapt extractors to new domain
      * soundcloud: Support --extractor-retries for original formats
      * twitch: Remove dead rechat subtitles
      * twitter: Fix view_count extraction
      * external: aria2c: Remove support for m3u8/dash protocols
      * ffmpegmetadata: Avoid erroneous ISO 639 conversions

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - yt-dlp is a command-line audio/video downloader. From 2023.09.24 until 2026.06.09, if curl is used as an     external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the     host for download fragments differs from their parent manifest's. At the file download stage, the cookies     are passed by yt-dlp to the file downloader via --cookie. However, unless these are loaded from a file,     this operation does not activate the cookie engine. As a result, curl will send cookies with requests to     domains or paths for which the cookies are not scoped. This vulnerability is fixed in 2026.06.09.
    (CVE-2026-50019)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-03f87de373 advisory.

    - Update to 2026.06.09. Fixes rhbz#2487407.
    - Mitigates CVE-2026-50019, CVE-2026-50023, CVE-2026-50574

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bb702c613b advisory.

    - Update to 2026.06.09. Fixes rhbz#2487407.
    - Mitigates CVE-2026-50019, CVE-2026-50023, CVE-2026-50574

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - yt-dlp is a command-line audio/video downloader. From 2023.09.24 until 2026.06.09, if curl is used as an
    external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the
    host for download fragments differs from their parent manifest's. At the file download stage, the cookies
    are passed by yt-dlp to the file downloader via --cookie. However, unless these are loaded from a file,
    this operation does not activate the cookie engine. As a result, curl will send cookies with requests to
    domains or paths for which the cookies are not scoped. This vulnerability is fixed in 2026.06.09.
    (CVE-2026-50019)

ID	Name	Product	Family	Severity
324063	openSUSE 16 Security Update : yt-dlp (openSUSE-SU-2026:21163-1)	Nessus	SuSE Local Security Checks	critical
322436	Linux Distros Unpatched Vulnerability : CVE-2026-50019	Nessus	Misc.	high
322360	Fedora 43 : yt-dlp (2026-03f87de373)	Nessus	Fedora Local Security Checks	critical
321858	Fedora 44 : yt-dlp (2026-bb702c613b)	Nessus	Fedora Local Security Checks	critical
443323	SCA: security update for yt-dlp (GHSA-f7j3-774f-rfhj)	Tenable Cloud Security	SCA Checks	high
443323	SCA: security update for yt-dlp (GHSA-f7j3-774f-rfhj)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-50019

high

Tenable Plugins

critical

high

critical

critical

high

high