yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519. The allowlist explicitly included the unsafe extensions .desktop, .url, and .webloc so that the functionality of the --write-link option (and its variants) could be preserved. These allowlist inclusions can be exploited by an attacker to write malicious OS-shortcut files in the context of a media or subtitles download. This vulnerability is fixed in 2026.06.09.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21163-1 advisory.

    Changes in yt-dlp:

    - Update to version 2026.06.09
      * Fixed [CVE-2026-50019]: File Downloader cookie leak with curl
      * Fixed [CVE-2026-50023]: Dangerous file type creation via         insufficient filename sanitization
      * Fixed [CVE-2026-50574]: Arbitrary code execution via manifest         downloads with aria2c
      * Added lockfile and pinned extras
      * Removed url, desktop and webloc from safe extensions
      * Extract supplemental codecs from DASH manifests
      * abematv: Extract subtitles
      * ard: Support new ardsounds domain
      * monstercat: Support older URLs
      * pornhub: Support browser impersonation
      * reddit: Fix unauthenticated extraction
      * rtp: Support multi-part episodes and --no-playlist
      * s4c: Extract more metadata
      * soop: Adapt extractors to new domain
      * soundcloud: Support --extractor-retries for original formats
      * twitch: Remove dead rechat subtitles
      * twitter: Fix view_count extraction
      * external: aria2c: Remove support for m3u8/dash protocols
      * ffmpegmetadata: Avoid erroneous ISO 639 conversions

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp     that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to     the user's filesystem, bypassing the remediation for CVE-2024-38519. The allowlist explicitly included the     unsafe extensions .desktop, .url, and .webloc so that the functionality of the --write-link option (and     its variants) could be preserved. These allowlist inclusions can be exploited by an attacker to write     malicious OS-shortcut files in the context of a media or subtitles download. This vulnerability is fixed     in 2026.06.09. (CVE-2026-50023)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-03f87de373 advisory.

    - Update to 2026.06.09. Fixes rhbz#2487407.
    - Mitigates CVE-2026-50019, CVE-2026-50023, CVE-2026-50574

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bb702c613b advisory.

    - Update to 2026.06.09. Fixes rhbz#2487407.
    - Mitigates CVE-2026-50019, CVE-2026-50023, CVE-2026-50574

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The detected version of the yt-dlp Python package is prior to 2026.6.9. It is, therefore, affected by multiple vulnerabilities:

  - A vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such     as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519.
    (CVE-2026-50023)

  - If aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream),     yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file     write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms,     this can lead to arbitrary code execution upon the next invocation of yt-dlp. (CVE-2026-50574)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp
    that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to
    the user's filesystem, bypassing the remediation for CVE-2024-38519. The allowlist explicitly included the
    unsafe extensions .desktop, .url, and .webloc so that the functionality of the --write-link option (and
    its variants) could be preserved. These allowlist inclusions can be exploited by an attacker to write
    malicious OS-shortcut files in the context of a media or subtitles download. This vulnerability is fixed
    in 2026.06.09. (CVE-2026-50023)

ID	Name	Product	Family	Severity
324063	openSUSE 16 Security Update : yt-dlp (openSUSE-SU-2026:21163-1)	Nessus	SuSE Local Security Checks	critical
322451	Linux Distros Unpatched Vulnerability : CVE-2026-50023	Nessus	Misc.	critical
322360	Fedora 43 : yt-dlp (2026-03f87de373)	Nessus	Fedora Local Security Checks	critical
321858	Fedora 44 : yt-dlp (2026-bb702c613b)	Nessus	Fedora Local Security Checks	critical
321527	Python Library yt-dlp < 2026.6.9 Multiple Vulnerabilities	Nessus	Misc.	critical
443335	SCA: security update for yt-dlp (GHSA-c6mh-fpjc-4pr3)	Tenable Cloud Security	SCA Checks	critical
443335	SCA: security update for yt-dlp (GHSA-c6mh-fpjc-4pr3)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2026-50023

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical