Detections
Analytics

openSUSE 16 Security Update : yt-dlp (openSUSE-SU-2026:22142-1)

high Nessus Plugin ID 370419

Language:

Synopsis

The remote openSUSE host is missing a security update.

Description

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22142-1 advisory.

 Changes in yt-dlp:

 Update to version 2026.08.19:

 * utils: float_or_none: Catch OverflowError
 * americastestkitchen: Fix season/series extraction
 * apple: Rework extractors
 * ard: Remove dead extractor
 * bandcamp: Support browser impersonation
 * bfmtv: Fix extractor
 * instagram: Fix logged-in extraction
 * showroom: Rework extractors
 * tiktok: Fix extractor
 * tiktok: Fix formats extraction
 * tiktok: Support share URLs
 * twitter: broadcast: Fix events handling
 * vimeo: Remove ios and macos clients
 * whyp: Fix extractor
 * youtube: Add visionos player client
 * youtube: Add web_embedded client fallbacks
 * youtube: Extract channel_follower_count for collaborators
 * youtube: Fix live adaptive fragments generation
 * youtube: Remove android_vr from default clients
 * youtube: tab: Always extract channel metadata
 * hls: Fix crash on empty fragment lists in tests

 Update to version 2026.07.04:

 * The minimum recommended Python version has been raised to 3.11
 * Security: [CVE-2026-55404 bsc#1286026] Downstream command injection via improper sanitization of --write-link output
 * Shortcut file data is now properly validated and sanitized when the --write-link options are used
 * Always include warnings in debug output
 * Fix allow-unsafe-ext compat option
 * Raise minimum recommended Python version to 3.11
 * Validate and escape values in --write-link output
 * cookies: Use ' instead of for SQL string quoting
 * utils: Deprecate make_dir in favor of make_parent_dirs
 * utils: HTTPHeaderDict: Fix __ior__
 * utils: parse_duration: Return int when appropriate
 * utils: parse_resolution: Support fps suffixes
 * utils: pkcs1pad: Fix invalid PKCS#1 v1.5 padding bytes
 * utils: qualities: Avoid repeated index lookups
 * utils: random_user_agent: Bump version range 143-149 => 144-150
 * Always include id in request error output
 * Fix request logging
 * arte: Fix playlist support
 * bandcamp: weekly: Fix extractor
 * bilibili: Fix API extraction
 * instagram: Detect when cookies are invalidated
 * instagram: Rework extractor
 * linkedin: Remove broken login support
 * mgtv: Fix VIP stream extraction
 * mxplayer: Fix extractors
 * mxplayer: Rework extractors
 * niconico: Fix error detection
 * niconico: Support shorts
 * omnyfm: Add extractors
 * openrec: Rework extractors
 * patreon: Support new URL format
 * peertube: Support password-protected videos
 * periscope: Improve metadata extraction
 * reddit: Remove broken login support
 * soundcloud: Extract uploader_url for playlists
 * soundcloud: Extract comments
 * soundcloud: Improve metadata extraction
 * streaks: Fix extractor
 * svt: Fix extractor
 * telewebion: Fix extractor
 * trovo: Remove dead extractors
 * truth: Support share URLs
 * tviplayer: Fix extractor
 * unsupported: Update unsupported sites
 * wrestleuniverse: vod: Fix extractor
 * youtube: Fix extract_relative_time for abbreviated units
 * youtube: Fix detection of forced preroll wait time
 * youtube: Fix minor issues
 * youtube: Support live adaptive formats
 * tab: Fix flat extraction of collaborators
 * tab: Fix flat playlist metadata extraction
 * tab: Fix metadata extraction
 * tab: Fix pagination
 * zan: Add extractor
 * zdf: Detect livestreams
 * zoom: clips: Add extractor
 * external: Fix resuming downloads with aria2c
 * external: curl: Support development versions
 * mhtml: Fix storyboard content-length calculation
 * build: Update 17 dependencies
 * build: Update 6 dependencies
 * cleanup: Fix invalid info dict fields
 * cleanup: Fix minor mistakes
 * cleanup: Remove RTSP and MMS support
 * cleanup: Replace dead example/test URL
 * cleanup: Miscellaneous: 997fa14
 * docs: Make No AI / No LLM Policy abundantly clear

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python313-yt-dlp, yt-dlp and / or yt-dlp-youtube-dl packages.

See Also

https://bugzilla.suse.com/1286026

https://www.suse.com/security/cve/CVE-2026-55404

Plugin Details

Severity: High

ID: 370419

File Name: openSUSE-2026-22142-1.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 10/22/2026

Updated: 10/22/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.23

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-55404

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:python313-yt-dlp, p-cpe:/a:novell:opensuse:yt-dlp-youtube-dl, p-cpe:/a:novell:opensuse:yt-dlp

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/20/2026

Vulnerability Publication Date: 7/8/2026

Reference Information

CVE: CVE-2026-55404

IAVB: 2026-B-0194