Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTTP or HTTPS URL reached by Streamlink can return a redirect to a local file URL, causing HTTPSession to read the local file and return its contents to the response consumer. This bypasses the direct file URL checks added for HLS and DASH content because the manifest contains an ordinary network URL and the scheme transition occurs later during fetch handling. The flaw applies to every request made through HTTPSession, and a segment fetch can place the local file contents into stream output. This issue is fixed in version 8.6.0.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d8cf5f20d7 advisory.

    ## streamlink 8.6.2 (2026-10-07)

    - SECURITY: fixed arbitrary local file read via `file://` URLs in DASH `Location` tags (`CVE-2026-TO-BE-     ASSIGNED` / [`GHSA-j7pf-m7gx-     jr33`](https://github.com/streamlink/streamlink/security/advisories/GHSA-j7pf-m7gx-jr33))     ([`98781761`](https://github.com/streamlink/streamlink/commit/987817618f57b6def852693e4e0a95fd9c8437f2))
    - Changed: `validate.xml_xpath()` and `validate.xml_xpath_string()` to include access to `re:test()`,     `re:match()` and `re:replace()` regex functions     ([#7151](https://github.com/streamlink/streamlink/pull/7151))
    - Changed: log format of deprecation warnings     ([#7141](https://github.com/streamlink/streamlink/pull/7141))
    - Fixed: missing deprecation warnings for already deprecated CLI arguments (req. Python 3.13+)     ([#7141](https://github.com/streamlink/streamlink/pull/7141))
    - Fixed: being able to close `SegmentedStreamReader` streams without opening them first, emitting log     records on garbage collection ([#7146](https://github.com/streamlink/streamlink/pull/7146))
    - Updated plugins:
      - blazetv: fixed live streams ([#7147](https://github.com/streamlink/streamlink/pull/7147))
      - cinergroup: fixed Bloomberg HT ([#7132](https://github.com/streamlink/streamlink/pull/7132))
      - dogan: fixed plugin ([#7138](https://github.com/streamlink/streamlink/pull/7138))
      - facebook: re-introduced plugin with new implementation     ([#7115](https://github.com/streamlink/streamlink/pull/7115))
      - vimeo: rewritten and fixed plugin ([#7069](https://github.com/streamlink/streamlink/pull/7069))
      - youtvua: added new plugin ([#7140](https://github.com/streamlink/streamlink/pull/7140))
    - Docs: tightened rules about AI-assisted contributions and security vulnerability reports     ([#7136](https://github.com/streamlink/streamlink/pull/7136),     [#7152](https://github.com/streamlink/streamlink/pull/7152))

    [Full changelog](https://github.com/streamlink/streamlink/compare/8.6.1...8.6.2)


    ## streamlink 8.6.1 (2026-09-16)

    - Fixed: compatibility with urllib3 2.8.0 ([#7117](https://github.com/streamlink/streamlink/pull/7117))

    [Full changelog](https://github.com/streamlink/streamlink/compare/8.6.0...8.6.1)


    ## streamlink 8.6.0 (2026-09-13)

    - SECURITY: fixed arbitrary local file read via HTTP(S) redirection to `file://` URL     ([`CVE-2026-92164`](https://nvd.nist.gov/vuln/detail/CVE-2026-92164) / [`GHSA-     vf2x-4v53-pm7v`](https://github.com/streamlink/streamlink/security/advisories/GHSA-vf2x-4v53-pm7v))     ([`4b99c64d`](https://github.com/streamlink/streamlink/commit/4b99c64dde21ea70c24d9ffdbd15849b05f465c6))
    - SECURITY: fixed insecure cross-scheme redirection (HTTPS -> HTTP)     ([`CVE-2026-92164`](https://nvd.nist.gov/vuln/detail/CVE-2026-92164) / [`GHSA-     vf2x-4v53-pm7v`](https://github.com/streamlink/streamlink/security/advisories/GHSA-vf2x-4v53-pm7v))     ([`4b99c64d`](https://github.com/streamlink/streamlink/commit/4b99c64dde21ea70c24d9ffdbd15849b05f465c6))
    - Added: official support for Python 3.15 ([#7026](https://github.com/streamlink/streamlink/pull/7026))
    - Added: support for HLS packed audio streams     ([#7083](https://github.com/streamlink/streamlink/pull/7083),     [#7082](https://github.com/streamlink/streamlink/pull/7082))
    - Added: `HLSSegment.{get,iter}_content()` and `HLSStreamWriter.{get,iter}_segment_content()` for being     able to modify segment data ([#7059](https://github.com/streamlink/streamlink/pull/7059))
    - Added: `itsoffset` option to `FFMPEGMuxer` ([#7081](https://github.com/streamlink/streamlink/pull/7081))
    - Added: `nextjs_inline_rsc()` to `validate` API     ([#7110](https://github.com/streamlink/streamlink/pull/7110))
    - Fixed: HTTP server of `--player-http`/`--player-continuous-http` binding to all interfaces     ([#7051](https://github.com/streamlink/streamlink/pull/7051))
    - Fixed: zero or negative duration values in HLS dateranges     ([#7074](https://github.com/streamlink/streamlink/pull/7074))
    - Fixed: incorrect `t` attribute evaluation in DASH `SegmentTimeline.S` nodes     ([#7075](https://github.com/streamlink/streamlink/pull/7075))
    - Updated plugins:
      - ard_live: removed plugin ([#7091](https://github.com/streamlink/streamlink/pull/7091))
      - ard_mediathek: rewritten and fixed plugin     ([#7090](https://github.com/streamlink/streamlink/pull/7090))
      - atresplayer: refactored stream retrieval ([#7062](https://github.com/streamlink/streamlink/pull/7062))
      - bigo: added MPEG-TS packet header decryption due to Bigo's web-protection     ([#7056](https://github.com/streamlink/streamlink/pull/7056),     [#7059](https://github.com/streamlink/streamlink/pull/7059))
      - bigo: worked around account requirements ([#7106](https://github.com/streamlink/streamlink/pull/7106),     [#7109](https://github.com/streamlink/streamlink/pull/7109))
      - cdnbg: fixed player\_url schema ([#7036](https://github.com/streamlink/streamlink/pull/7036))
      - douyu: fixed API call failures on systems with unsynced clocks     ([#7065](https://github.com/streamlink/streamlink/pull/7065))
      - filmon: updated URL matcher and switched to v2 APIs     ([#7105](https://github.com/streamlink/streamlink/pull/7105))
      - goodgame: fixed stream retrieval ([#7086](https://github.com/streamlink/streamlink/pull/7086))
      - kick: fixed VODs ([#7108](https://github.com/streamlink/streamlink/pull/7108))
      - nimotv: fixed access to streams ([#7111](https://github.com/streamlink/streamlink/pull/7111))
      - okru: fixed metadata schema ([#7092](https://github.com/streamlink/streamlink/pull/7092))
      - piczel: removed plugin ([#7102](https://github.com/streamlink/streamlink/pull/7102))
      - pluto: fixed URL matcher, channel ID resolver and VODs     ([#7048](https://github.com/streamlink/streamlink/pull/7048),     [#7100](https://github.com/streamlink/streamlink/pull/7100))
      - tiktok: rewritten and fixed stream data schema for access to origin streams     ([#7077](https://github.com/streamlink/streamlink/pull/7077))
      - twitch: added support for portrait-format streams     ([#7087](https://github.com/streamlink/streamlink/pull/7087))
      - twitch: fixed missing category stream metadata breaking all stream metadata     ([#7025](https://github.com/streamlink/streamlink/pull/7025))
      - vidio: rewritten and fixed plugin ([#7063](https://github.com/streamlink/streamlink/pull/7063))
      - zdf_mediathek: rewritten and fixed plugin     ([#7093](https://github.com/streamlink/streamlink/pull/7093))
    - Dependencies: bumped min. version requirement of lxml to `5.0.0`     ([#7029](https://github.com/streamlink/streamlink/pull/7029))

    [Full changelog](https://github.com/streamlink/streamlink/compare/8.5.0...8.6.0)


    ## streamlink 8.5.0 (2026-08-01)

    - Fixed: named-pipe player inputs not being cleaned up on pre-open failure     ([#6935](https://github.com/streamlink/streamlink/pull/6935))
    - Fixed: stream start offsets being incorrectly cast to int in HLS     ([#6941](https://github.com/streamlink/streamlink/pull/6941))
    - Fixed: `hls-playlist-reload-time` not accepting floats     ([#6957](https://github.com/streamlink/streamlink/pull/6957))
    - Refactored: `HTTPSession` and fixed many typing issues     ([#6924](https://github.com/streamlink/streamlink/pull/6924))
    - Refactored: `MPDNode` in DASH manifest parser to allow attribute namespaces     ([#6988](https://github.com/streamlink/streamlink/pull/6988))
    - Updated plugins:
      - douyin: fixed validation schema ([#6930](https://github.com/streamlink/streamlink/pull/6930))
      - douyu: re-introduced plugin with new implementation     ([#6959](https://github.com/streamlink/streamlink/pull/6959),     [#7003](https://github.com/streamlink/streamlink/pull/7003))
      - mdstrm: added support for VODs / embedded streams with access tokens     ([#6994](https://github.com/streamlink/streamlink/pull/6994))
      - nos: rewritten and fixed plugin ([#6954](https://github.com/streamlink/streamlink/pull/6954))
      - radiko: fixed live\_url value ([#6962](https://github.com/streamlink/streamlink/pull/6962))
      - trovo: removed plugin ([#6999](https://github.com/streamlink/streamlink/pull/6999))
      - tvazteca: added new plugin ([#6994](https://github.com/streamlink/streamlink/pull/6994))
    - Docs: clarified requirements of Twitch high quality streams     ([#6992](https://github.com/streamlink/streamlink/pull/6992))
    - Tests: fixed test failures since Python 3.15 beta 1     ([#6919](https://github.com/streamlink/streamlink/pull/6919))
    - Security: made GitHub releases immutable ([#6927](https://github.com/streamlink/streamlink/pull/6927))
    - Security: pinned all GitHub actions to commit IDs     ([#6936](https://github.com/streamlink/streamlink/pull/6936))
    - Security: switched to uv lockfile for all CI workflows and for building release assets     ([#6948](https://github.com/streamlink/streamlink/pull/6948))
    - Misc: added pre-built FISH shell completions to release tarballs and wheels     ([#7014](https://github.com/streamlink/streamlink/pull/7014))

    [Full changelog](https://github.com/streamlink/streamlink/compare/8.4.0...8.5.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6ffee677d1 advisory.

    ## streamlink 8.6.2 (2026-10-07)

    - SECURITY: fixed arbitrary local file read via `file://` URLs in DASH `Location` tags (`CVE-2026-TO-BE-     ASSIGNED` / [`GHSA-j7pf-m7gx-     jr33`](https://github.com/streamlink/streamlink/security/advisories/GHSA-j7pf-m7gx-jr33))     ([`98781761`](https://github.com/streamlink/streamlink/commit/987817618f57b6def852693e4e0a95fd9c8437f2))
    - Changed: `validate.xml_xpath()` and `validate.xml_xpath_string()` to include access to `re:test()`,     `re:match()` and `re:replace()` regex functions     ([#7151](https://github.com/streamlink/streamlink/pull/7151))
    - Changed: log format of deprecation warnings     ([#7141](https://github.com/streamlink/streamlink/pull/7141))
    - Fixed: missing deprecation warnings for already deprecated CLI arguments (req. Python 3.13+)     ([#7141](https://github.com/streamlink/streamlink/pull/7141))
    - Fixed: being able to close `SegmentedStreamReader` streams without opening them first, emitting log     records on garbage collection ([#7146](https://github.com/streamlink/streamlink/pull/7146))
    - Updated plugins:
      - blazetv: fixed live streams ([#7147](https://github.com/streamlink/streamlink/pull/7147))
      - cinergroup: fixed Bloomberg HT ([#7132](https://github.com/streamlink/streamlink/pull/7132))
      - dogan: fixed plugin ([#7138](https://github.com/streamlink/streamlink/pull/7138))
      - facebook: re-introduced plugin with new implementation     ([#7115](https://github.com/streamlink/streamlink/pull/7115))
      - vimeo: rewritten and fixed plugin ([#7069](https://github.com/streamlink/streamlink/pull/7069))
      - youtvua: added new plugin ([#7140](https://github.com/streamlink/streamlink/pull/7140))
    - Docs: tightened rules about AI-assisted contributions and security vulnerability reports     ([#7136](https://github.com/streamlink/streamlink/pull/7136),     [#7152](https://github.com/streamlink/streamlink/pull/7152))

    [Full changelog](https://github.com/streamlink/streamlink/compare/8.6.1...8.6.2)


    ## streamlink 8.6.1 (2026-09-16)

    - Fixed: compatibility with urllib3 2.8.0 ([#7117](https://github.com/streamlink/streamlink/pull/7117))

    [Full changelog](https://github.com/streamlink/streamlink/compare/8.6.0...8.6.1)


    ## streamlink 8.6.0 (2026-09-13)

    - SECURITY: fixed arbitrary local file read via HTTP(S) redirection to `file://` URL     ([`CVE-2026-92164`](https://nvd.nist.gov/vuln/detail/CVE-2026-92164) / [`GHSA-     vf2x-4v53-pm7v`](https://github.com/streamlink/streamlink/security/advisories/GHSA-vf2x-4v53-pm7v))     ([`4b99c64d`](https://github.com/streamlink/streamlink/commit/4b99c64dde21ea70c24d9ffdbd15849b05f465c6))
    - SECURITY: fixed insecure cross-scheme redirection (HTTPS -> HTTP)     ([`CVE-2026-92164`](https://nvd.nist.gov/vuln/detail/CVE-2026-92164) / [`GHSA-     vf2x-4v53-pm7v`](https://github.com/streamlink/streamlink/security/advisories/GHSA-vf2x-4v53-pm7v))     ([`4b99c64d`](https://github.com/streamlink/streamlink/commit/4b99c64dde21ea70c24d9ffdbd15849b05f465c6))
    - Added: official support for Python 3.15 ([#7026](https://github.com/streamlink/streamlink/pull/7026))
    - Added: support for HLS packed audio streams     ([#7083](https://github.com/streamlink/streamlink/pull/7083),     [#7082](https://github.com/streamlink/streamlink/pull/7082))
    - Added: `HLSSegment.{get,iter}_content()` and `HLSStreamWriter.{get,iter}_segment_content()` for being     able to modify segment data ([#7059](https://github.com/streamlink/streamlink/pull/7059))
    - Added: `itsoffset` option to `FFMPEGMuxer` ([#7081](https://github.com/streamlink/streamlink/pull/7081))
    - Added: `nextjs_inline_rsc()` to `validate` API     ([#7110](https://github.com/streamlink/streamlink/pull/7110))
    - Fixed: HTTP server of `--player-http`/`--player-continuous-http` binding to all interfaces     ([#7051](https://github.com/streamlink/streamlink/pull/7051))
    - Fixed: zero or negative duration values in HLS dateranges     ([#7074](https://github.com/streamlink/streamlink/pull/7074))
    - Fixed: incorrect `t` attribute evaluation in DASH `SegmentTimeline.S` nodes     ([#7075](https://github.com/streamlink/streamlink/pull/7075))
    - Updated plugins:
      - ard_live: removed plugin ([#7091](https://github.com/streamlink/streamlink/pull/7091))
      - ard_mediathek: rewritten and fixed plugin     ([#7090](https://github.com/streamlink/streamlink/pull/7090))
      - atresplayer: refactored stream retrieval ([#7062](https://github.com/streamlink/streamlink/pull/7062))
      - bigo: added MPEG-TS packet header decryption due to Bigo's web-protection     ([#7056](https://github.com/streamlink/streamlink/pull/7056),     [#7059](https://github.com/streamlink/streamlink/pull/7059))
      - bigo: worked around account requirements ([#7106](https://github.com/streamlink/streamlink/pull/7106),     [#7109](https://github.com/streamlink/streamlink/pull/7109))
      - cdnbg: fixed player\_url schema ([#7036](https://github.com/streamlink/streamlink/pull/7036))
      - douyu: fixed API call failures on systems with unsynced clocks     ([#7065](https://github.com/streamlink/streamlink/pull/7065))
      - filmon: updated URL matcher and switched to v2 APIs     ([#7105](https://github.com/streamlink/streamlink/pull/7105))
      - goodgame: fixed stream retrieval ([#7086](https://github.com/streamlink/streamlink/pull/7086))
      - kick: fixed VODs ([#7108](https://github.com/streamlink/streamlink/pull/7108))
      - nimotv: fixed access to streams ([#7111](https://github.com/streamlink/streamlink/pull/7111))
      - okru: fixed metadata schema ([#7092](https://github.com/streamlink/streamlink/pull/7092))
      - piczel: removed plugin ([#7102](https://github.com/streamlink/streamlink/pull/7102))
      - pluto: fixed URL matcher, channel ID resolver and VODs     ([#7048](https://github.com/streamlink/streamlink/pull/7048),     [#7100](https://github.com/streamlink/streamlink/pull/7100))
      - tiktok: rewritten and fixed stream data schema for access to origin streams     ([#7077](https://github.com/streamlink/streamlink/pull/7077))
      - twitch: added support for portrait-format streams     ([#7087](https://github.com/streamlink/streamlink/pull/7087))
      - twitch: fixed missing category stream metadata breaking all stream metadata     ([#7025](https://github.com/streamlink/streamlink/pull/7025))
      - vidio: rewritten and fixed plugin ([#7063](https://github.com/streamlink/streamlink/pull/7063))
      - zdf_mediathek: rewritten and fixed plugin     ([#7093](https://github.com/streamlink/streamlink/pull/7093))
    - Dependencies: bumped min. version requirement of lxml to `5.0.0`     ([#7029](https://github.com/streamlink/streamlink/pull/7029))

    [Full changelog](https://github.com/streamlink/streamlink/compare/8.5.0...8.6.0)


    ## streamlink 8.5.0 (2026-08-01)

    - Fixed: named-pipe player inputs not being cleaned up on pre-open failure     ([#6935](https://github.com/streamlink/streamlink/pull/6935))
    - Fixed: stream start offsets being incorrectly cast to int in HLS     ([#6941](https://github.com/streamlink/streamlink/pull/6941))
    - Fixed: `hls-playlist-reload-time` not accepting floats     ([#6957](https://github.com/streamlink/streamlink/pull/6957))
    - Refactored: `HTTPSession` and fixed many typing issues     ([#6924](https://github.com/streamlink/streamlink/pull/6924))
    - Refactored: `MPDNode` in DASH manifest parser to allow attribute namespaces     ([#6988](https://github.com/streamlink/streamlink/pull/6988))
    - Updated plugins:
      - douyin: fixed validation schema ([#6930](https://github.com/streamlink/streamlink/pull/6930))
      - douyu: re-introduced plugin with new implementation     ([#6959](https://github.com/streamlink/streamlink/pull/6959),     [#7003](https://github.com/streamlink/streamlink/pull/7003))
      - mdstrm: added support for VODs / embedded streams with access tokens     ([#6994](https://github.com/streamlink/streamlink/pull/6994))
      - nos: rewritten and fixed plugin ([#6954](https://github.com/streamlink/streamlink/pull/6954))
      - radiko: fixed live\_url value ([#6962](https://github.com/streamlink/streamlink/pull/6962))
      - trovo: removed plugin ([#6999](https://github.com/streamlink/streamlink/pull/6999))
      - tvazteca: added new plugin ([#6994](https://github.com/streamlink/streamlink/pull/6994))
    - Docs: clarified requirements of Twitch high quality streams     ([#6992](https://github.com/streamlink/streamlink/pull/6992))
    - Tests: fixed test failures since Python 3.15 beta 1     ([#6919](https://github.com/streamlink/streamlink/pull/6919))
    - Security: made GitHub releases immutable ([#6927](https://github.com/streamlink/streamlink/pull/6927))
    - Security: pinned all GitHub actions to commit IDs     ([#6936](https://github.com/streamlink/streamlink/pull/6936))
    - Security: switched to uv lockfile for all CI workflows and for building release assets     ([#6948](https://github.com/streamlink/streamlink/pull/6948))
    - Misc: added pre-built FISH shell completions to release tarballs and wheels     ([#7014](https://github.com/streamlink/streamlink/pull/7014))

    [Full changelog](https://github.com/streamlink/streamlink/compare/8.4.0...8.5.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-73fcc91d16 advisory.

    ## streamlink 8.6.2 (2026-10-07)

    - SECURITY: fixed arbitrary local file read via `file://` URLs in DASH `Location` tags (`CVE-2026-TO-BE-     ASSIGNED` / [`GHSA-j7pf-m7gx-     jr33`](https://github.com/streamlink/streamlink/security/advisories/GHSA-j7pf-m7gx-jr33))     ([`98781761`](https://github.com/streamlink/streamlink/commit/987817618f57b6def852693e4e0a95fd9c8437f2))
    - Changed: `validate.xml_xpath()` and `validate.xml_xpath_string()` to include access to `re:test()`,     `re:match()` and `re:replace()` regex functions     ([#7151](https://github.com/streamlink/streamlink/pull/7151))
    - Changed: log format of deprecation warnings     ([#7141](https://github.com/streamlink/streamlink/pull/7141))
    - Fixed: missing deprecation warnings for already deprecated CLI arguments (req. Python 3.13+)     ([#7141](https://github.com/streamlink/streamlink/pull/7141))
    - Fixed: being able to close `SegmentedStreamReader` streams without opening them first, emitting log     records on garbage collection ([#7146](https://github.com/streamlink/streamlink/pull/7146))
    - Updated plugins:
      - blazetv: fixed live streams ([#7147](https://github.com/streamlink/streamlink/pull/7147))
      - cinergroup: fixed Bloomberg HT ([#7132](https://github.com/streamlink/streamlink/pull/7132))
      - dogan: fixed plugin ([#7138](https://github.com/streamlink/streamlink/pull/7138))
      - facebook: re-introduced plugin with new implementation     ([#7115](https://github.com/streamlink/streamlink/pull/7115))
      - vimeo: rewritten and fixed plugin ([#7069](https://github.com/streamlink/streamlink/pull/7069))
      - youtvua: added new plugin ([#7140](https://github.com/streamlink/streamlink/pull/7140))
    - Docs: tightened rules about AI-assisted contributions and security vulnerability reports     ([#7136](https://github.com/streamlink/streamlink/pull/7136),     [#7152](https://github.com/streamlink/streamlink/pull/7152))

    [Full changelog](https://github.com/streamlink/streamlink/compare/8.6.1...8.6.2)


    ## streamlink 8.6.1 (2026-09-16)

    - Fixed: compatibility with urllib3 2.8.0 ([#7117](https://github.com/streamlink/streamlink/pull/7117))

    [Full changelog](https://github.com/streamlink/streamlink/compare/8.6.0...8.6.1)


    ## streamlink 8.6.0 (2026-09-13)

    - SECURITY: fixed arbitrary local file read via HTTP(S) redirection to `file://` URL     ([`CVE-2026-92164`](https://nvd.nist.gov/vuln/detail/CVE-2026-92164) / [`GHSA-     vf2x-4v53-pm7v`](https://github.com/streamlink/streamlink/security/advisories/GHSA-vf2x-4v53-pm7v))     ([`4b99c64d`](https://github.com/streamlink/streamlink/commit/4b99c64dde21ea70c24d9ffdbd15849b05f465c6))
    - SECURITY: fixed insecure cross-scheme redirection (HTTPS -> HTTP)     ([`CVE-2026-92164`](https://nvd.nist.gov/vuln/detail/CVE-2026-92164) / [`GHSA-     vf2x-4v53-pm7v`](https://github.com/streamlink/streamlink/security/advisories/GHSA-vf2x-4v53-pm7v))     ([`4b99c64d`](https://github.com/streamlink/streamlink/commit/4b99c64dde21ea70c24d9ffdbd15849b05f465c6))
    - Added: official support for Python 3.15 ([#7026](https://github.com/streamlink/streamlink/pull/7026))
    - Added: support for HLS packed audio streams     ([#7083](https://github.com/streamlink/streamlink/pull/7083),     [#7082](https://github.com/streamlink/streamlink/pull/7082))
    - Added: `HLSSegment.{get,iter}_content()` and `HLSStreamWriter.{get,iter}_segment_content()` for being     able to modify segment data ([#7059](https://github.com/streamlink/streamlink/pull/7059))
    - Added: `itsoffset` option to `FFMPEGMuxer` ([#7081](https://github.com/streamlink/streamlink/pull/7081))
    - Added: `nextjs_inline_rsc()` to `validate` API     ([#7110](https://github.com/streamlink/streamlink/pull/7110))
    - Fixed: HTTP server of `--player-http`/`--player-continuous-http` binding to all interfaces     ([#7051](https://github.com/streamlink/streamlink/pull/7051))
    - Fixed: zero or negative duration values in HLS dateranges     ([#7074](https://github.com/streamlink/streamlink/pull/7074))
    - Fixed: incorrect `t` attribute evaluation in DASH `SegmentTimeline.S` nodes     ([#7075](https://github.com/streamlink/streamlink/pull/7075))
    - Updated plugins:
      - ard_live: removed plugin ([#7091](https://github.com/streamlink/streamlink/pull/7091))
      - ard_mediathek: rewritten and fixed plugin     ([#7090](https://github.com/streamlink/streamlink/pull/7090))
      - atresplayer: refactored stream retrieval ([#7062](https://github.com/streamlink/streamlink/pull/7062))
      - bigo: added MPEG-TS packet header decryption due to Bigo's web-protection     ([#7056](https://github.com/streamlink/streamlink/pull/7056),     [#7059](https://github.com/streamlink/streamlink/pull/7059))
      - bigo: worked around account requirements ([#7106](https://github.com/streamlink/streamlink/pull/7106),     [#7109](https://github.com/streamlink/streamlink/pull/7109))
      - cdnbg: fixed player\_url schema ([#7036](https://github.com/streamlink/streamlink/pull/7036))
      - douyu: fixed API call failures on systems with unsynced clocks     ([#7065](https://github.com/streamlink/streamlink/pull/7065))
      - filmon: updated URL matcher and switched to v2 APIs     ([#7105](https://github.com/streamlink/streamlink/pull/7105))
      - goodgame: fixed stream retrieval ([#7086](https://github.com/streamlink/streamlink/pull/7086))
      - kick: fixed VODs ([#7108](https://github.com/streamlink/streamlink/pull/7108))
      - nimotv: fixed access to streams ([#7111](https://github.com/streamlink/streamlink/pull/7111))
      - okru: fixed metadata schema ([#7092](https://github.com/streamlink/streamlink/pull/7092))
      - piczel: removed plugin ([#7102](https://github.com/streamlink/streamlink/pull/7102))
      - pluto: fixed URL matcher, channel ID resolver and VODs     ([#7048](https://github.com/streamlink/streamlink/pull/7048),     [#7100](https://github.com/streamlink/streamlink/pull/7100))
      - tiktok: rewritten and fixed stream data schema for access to origin streams     ([#7077](https://github.com/streamlink/streamlink/pull/7077))
      - twitch: added support for portrait-format streams     ([#7087](https://github.com/streamlink/streamlink/pull/7087))
      - twitch: fixed missing category stream metadata breaking all stream metadata     ([#7025](https://github.com/streamlink/streamlink/pull/7025))
      - vidio: rewritten and fixed plugin ([#7063](https://github.com/streamlink/streamlink/pull/7063))
      - zdf_mediathek: rewritten and fixed plugin     ([#7093](https://github.com/streamlink/streamlink/pull/7093))
    - Dependencies: bumped min. version requirement of lxml to `5.0.0`     ([#7029](https://github.com/streamlink/streamlink/pull/7029))

    [Full changelog](https://github.com/streamlink/streamlink/compare/8.5.0...8.6.0)


    ## streamlink 8.5.0 (2026-08-01)

    - Fixed: named-pipe player inputs not being cleaned up on pre-open failure     ([#6935](https://github.com/streamlink/streamlink/pull/6935))
    - Fixed: stream start offsets being incorrectly cast to int in HLS     ([#6941](https://github.com/streamlink/streamlink/pull/6941))
    - Fixed: `hls-playlist-reload-time` not accepting floats     ([#6957](https://github.com/streamlink/streamlink/pull/6957))
    - Refactored: `HTTPSession` and fixed many typing issues     ([#6924](https://github.com/streamlink/streamlink/pull/6924))
    - Refactored: `MPDNode` in DASH manifest parser to allow attribute namespaces     ([#6988](https://github.com/streamlink/streamlink/pull/6988))
    - Updated plugins:
      - douyin: fixed validation schema ([#6930](https://github.com/streamlink/streamlink/pull/6930))
      - douyu: re-introduced plugin with new implementation     ([#6959](https://github.com/streamlink/streamlink/pull/6959),     [#7003](https://github.com/streamlink/streamlink/pull/7003))
      - mdstrm: added support for VODs / embedded streams with access tokens     ([#6994](https://github.com/streamlink/streamlink/pull/6994))
      - nos: rewritten and fixed plugin ([#6954](https://github.com/streamlink/streamlink/pull/6954))
      - radiko: fixed live\_url value ([#6962](https://github.com/streamlink/streamlink/pull/6962))
      - trovo: removed plugin ([#6999](https://github.com/streamlink/streamlink/pull/6999))
      - tvazteca: added new plugin ([#6994](https://github.com/streamlink/streamlink/pull/6994))
    - Docs: clarified requirements of Twitch high quality streams     ([#6992](https://github.com/streamlink/streamlink/pull/6992))
    - Tests: fixed test failures since Python 3.15 beta 1     ([#6919](https://github.com/streamlink/streamlink/pull/6919))
    - Security: made GitHub releases immutable ([#6927](https://github.com/streamlink/streamlink/pull/6927))
    - Security: pinned all GitHub actions to commit IDs     ([#6936](https://github.com/streamlink/streamlink/pull/6936))
    - Security: switched to uv lockfile for all CI workflows and for building release assets     ([#6948](https://github.com/streamlink/streamlink/pull/6948))
    - Misc: added pre-built FISH shell completions to release tarballs and wheels     ([#7014](https://github.com/streamlink/streamlink/pull/7014))

    [Full changelog](https://github.com/streamlink/streamlink/compare/8.4.0...8.5.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to     8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from     requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTTP or HTTPS     URL reached by Streamlink can return a redirect to a local file URL, causing HTTPSession to read the local     file and return its contents to the response consumer. This bypasses the direct file URL checks added for     HLS and DASH content because the manifest contains an ordinary network URL and the scheme transition     occurs later during fetch handling. The flaw applies to every request made through HTTPSession, and a     segment fetch can place the local file contents into stream output. This issue is fixed in version 8.6.0.
    (CVE-2026-92164)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
374881	Fedora 43 : python-streamlink (2026-d8cf5f20d7)	Nessus	Fedora Local Security Checks	Local	medium
374880	Fedora 44 : python-streamlink (2026-6ffee677d1)	Nessus	Fedora Local Security Checks	Local	medium
374876	Fedora 45 : python-streamlink (2026-73fcc91d16)	Nessus	Fedora Local Security Checks	Local	medium
350247	Linux Distros Unpatched Vulnerability : CVE-2026-92164	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-92164

medium

Tenable Plugins

medium

medium

medium

medium