Detections
Analytics

Fedora 44 : python-streamlink (2026-6ffee677d1)

medium Nessus Plugin ID 374880

Language:

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6ffee677d1 advisory.

 ## streamlink 8.6.2 (2026-10-07)

 - SECURITY: fixed arbitrary local file read via `file://` URLs in DASH `Location` tags (`CVE-2026-TO-BE- ASSIGNED` / [`GHSA-j7pf-m7gx- jr33`](https://github.com/streamlink/streamlink/security/advisories/GHSA-j7pf-m7gx-jr33)) ([`98781761`](https://github.com/streamlink/streamlink/commit/987817618f57b6def852693e4e0a95fd9c8437f2))
 - Changed: `validate.xml_xpath()` and `validate.xml_xpath_string()` to include access to `re:test()`, `re:match()` and `re:replace()` regex functions ([#7151](https://github.com/streamlink/streamlink/pull/7151))
 - Changed: log format of deprecation warnings ([#7141](https://github.com/streamlink/streamlink/pull/7141))
 - Fixed: missing deprecation warnings for already deprecated CLI arguments (req. Python 3.13+) ([#7141](https://github.com/streamlink/streamlink/pull/7141))
 - Fixed: being able to close `SegmentedStreamReader` streams without opening them first, emitting log records on garbage collection ([#7146](https://github.com/streamlink/streamlink/pull/7146))
 - Updated plugins:
 - blazetv: fixed live streams ([#7147](https://github.com/streamlink/streamlink/pull/7147))
 - cinergroup: fixed Bloomberg HT ([#7132](https://github.com/streamlink/streamlink/pull/7132))
 - dogan: fixed plugin ([#7138](https://github.com/streamlink/streamlink/pull/7138))
 - facebook: re-introduced plugin with new implementation ([#7115](https://github.com/streamlink/streamlink/pull/7115))
 - vimeo: rewritten and fixed plugin ([#7069](https://github.com/streamlink/streamlink/pull/7069))
 - youtvua: added new plugin ([#7140](https://github.com/streamlink/streamlink/pull/7140))
 - Docs: tightened rules about AI-assisted contributions and security vulnerability reports ([#7136](https://github.com/streamlink/streamlink/pull/7136), [#7152](https://github.com/streamlink/streamlink/pull/7152))

 [Full changelog](https://github.com/streamlink/streamlink/compare/8.6.1...8.6.2)


 ## streamlink 8.6.1 (2026-09-16)

 - Fixed: compatibility with urllib3 2.8.0 ([#7117](https://github.com/streamlink/streamlink/pull/7117))

 [Full changelog](https://github.com/streamlink/streamlink/compare/8.6.0...8.6.1)


 ## streamlink 8.6.0 (2026-09-13)

 - SECURITY: fixed arbitrary local file read via HTTP(S) redirection to `file://` URL ([`CVE-2026-92164`](https://nvd.nist.gov/vuln/detail/CVE-2026-92164) / [`GHSA- vf2x-4v53-pm7v`](https://github.com/streamlink/streamlink/security/advisories/GHSA-vf2x-4v53-pm7v)) ([`4b99c64d`](https://github.com/streamlink/streamlink/commit/4b99c64dde21ea70c24d9ffdbd15849b05f465c6))
 - SECURITY: fixed insecure cross-scheme redirection (HTTPS -> HTTP) ([`CVE-2026-92164`](https://nvd.nist.gov/vuln/detail/CVE-2026-92164) / [`GHSA- vf2x-4v53-pm7v`](https://github.com/streamlink/streamlink/security/advisories/GHSA-vf2x-4v53-pm7v)) ([`4b99c64d`](https://github.com/streamlink/streamlink/commit/4b99c64dde21ea70c24d9ffdbd15849b05f465c6))
 - Added: official support for Python 3.15 ([#7026](https://github.com/streamlink/streamlink/pull/7026))
 - Added: support for HLS packed audio streams ([#7083](https://github.com/streamlink/streamlink/pull/7083), [#7082](https://github.com/streamlink/streamlink/pull/7082))
 - Added: `HLSSegment.{get,iter}_content()` and `HLSStreamWriter.{get,iter}_segment_content()` for being able to modify segment data ([#7059](https://github.com/streamlink/streamlink/pull/7059))
 - Added: `itsoffset` option to `FFMPEGMuxer` ([#7081](https://github.com/streamlink/streamlink/pull/7081))
 - Added: `nextjs_inline_rsc()` to `validate` API ([#7110](https://github.com/streamlink/streamlink/pull/7110))
 - Fixed: HTTP server of `--player-http`/`--player-continuous-http` binding to all interfaces ([#7051](https://github.com/streamlink/streamlink/pull/7051))
 - Fixed: zero or negative duration values in HLS dateranges ([#7074](https://github.com/streamlink/streamlink/pull/7074))
 - Fixed: incorrect `t` attribute evaluation in DASH `SegmentTimeline.S` nodes ([#7075](https://github.com/streamlink/streamlink/pull/7075))
 - Updated plugins:
 - ard_live: removed plugin ([#7091](https://github.com/streamlink/streamlink/pull/7091))
 - ard_mediathek: rewritten and fixed plugin ([#7090](https://github.com/streamlink/streamlink/pull/7090))
 - atresplayer: refactored stream retrieval ([#7062](https://github.com/streamlink/streamlink/pull/7062))
 - bigo: added MPEG-TS packet header decryption due to Bigo's web-protection ([#7056](https://github.com/streamlink/streamlink/pull/7056), [#7059](https://github.com/streamlink/streamlink/pull/7059))
 - bigo: worked around account requirements ([#7106](https://github.com/streamlink/streamlink/pull/7106), [#7109](https://github.com/streamlink/streamlink/pull/7109))
 - cdnbg: fixed player\_url schema ([#7036](https://github.com/streamlink/streamlink/pull/7036))
 - douyu: fixed API call failures on systems with unsynced clocks ([#7065](https://github.com/streamlink/streamlink/pull/7065))
 - filmon: updated URL matcher and switched to v2 APIs ([#7105](https://github.com/streamlink/streamlink/pull/7105))
 - goodgame: fixed stream retrieval ([#7086](https://github.com/streamlink/streamlink/pull/7086))
 - kick: fixed VODs ([#7108](https://github.com/streamlink/streamlink/pull/7108))
 - nimotv: fixed access to streams ([#7111](https://github.com/streamlink/streamlink/pull/7111))
 - okru: fixed metadata schema ([#7092](https://github.com/streamlink/streamlink/pull/7092))
 - piczel: removed plugin ([#7102](https://github.com/streamlink/streamlink/pull/7102))
 - pluto: fixed URL matcher, channel ID resolver and VODs ([#7048](https://github.com/streamlink/streamlink/pull/7048), [#7100](https://github.com/streamlink/streamlink/pull/7100))
 - tiktok: rewritten and fixed stream data schema for access to origin streams ([#7077](https://github.com/streamlink/streamlink/pull/7077))
 - twitch: added support for portrait-format streams ([#7087](https://github.com/streamlink/streamlink/pull/7087))
 - twitch: fixed missing category stream metadata breaking all stream metadata ([#7025](https://github.com/streamlink/streamlink/pull/7025))
 - vidio: rewritten and fixed plugin ([#7063](https://github.com/streamlink/streamlink/pull/7063))
 - zdf_mediathek: rewritten and fixed plugin ([#7093](https://github.com/streamlink/streamlink/pull/7093))
 - Dependencies: bumped min. version requirement of lxml to `5.0.0` ([#7029](https://github.com/streamlink/streamlink/pull/7029))

 [Full changelog](https://github.com/streamlink/streamlink/compare/8.5.0...8.6.0)


 ## streamlink 8.5.0 (2026-08-01)

 - Fixed: named-pipe player inputs not being cleaned up on pre-open failure ([#6935](https://github.com/streamlink/streamlink/pull/6935))
 - Fixed: stream start offsets being incorrectly cast to int in HLS ([#6941](https://github.com/streamlink/streamlink/pull/6941))
 - Fixed: `hls-playlist-reload-time` not accepting floats ([#6957](https://github.com/streamlink/streamlink/pull/6957))
 - Refactored: `HTTPSession` and fixed many typing issues ([#6924](https://github.com/streamlink/streamlink/pull/6924))
 - Refactored: `MPDNode` in DASH manifest parser to allow attribute namespaces ([#6988](https://github.com/streamlink/streamlink/pull/6988))
 - Updated plugins:
 - douyin: fixed validation schema ([#6930](https://github.com/streamlink/streamlink/pull/6930))
 - douyu: re-introduced plugin with new implementation ([#6959](https://github.com/streamlink/streamlink/pull/6959), [#7003](https://github.com/streamlink/streamlink/pull/7003))
 - mdstrm: added support for VODs / embedded streams with access tokens ([#6994](https://github.com/streamlink/streamlink/pull/6994))
 - nos: rewritten and fixed plugin ([#6954](https://github.com/streamlink/streamlink/pull/6954))
 - radiko: fixed live\_url value ([#6962](https://github.com/streamlink/streamlink/pull/6962))
 - trovo: removed plugin ([#6999](https://github.com/streamlink/streamlink/pull/6999))
 - tvazteca: added new plugin ([#6994](https://github.com/streamlink/streamlink/pull/6994))
 - Docs: clarified requirements of Twitch high quality streams ([#6992](https://github.com/streamlink/streamlink/pull/6992))
 - Tests: fixed test failures since Python 3.15 beta 1 ([#6919](https://github.com/streamlink/streamlink/pull/6919))
 - Security: made GitHub releases immutable ([#6927](https://github.com/streamlink/streamlink/pull/6927))
 - Security: pinned all GitHub actions to commit IDs ([#6936](https://github.com/streamlink/streamlink/pull/6936))
 - Security: switched to uv lockfile for all CI workflows and for building release assets ([#6948](https://github.com/streamlink/streamlink/pull/6948))
 - Misc: added pre-built FISH shell completions to release tarballs and wheels ([#7014](https://github.com/streamlink/streamlink/pull/7014))

 [Full changelog](https://github.com/streamlink/streamlink/compare/8.4.0...8.5.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected python-streamlink package.

See Also

https://bodhi.fedoraproject.org/updates/FEDORA-2026-6ffee677d1

Plugin Details

Severity: Medium

ID: 374880

File Name: fedora_2026-6ffee677d1.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 11/2/2026

Updated: 11/2/2026

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.6

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-92164

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:fedoraproject:fedora:44, p-cpe:/a:fedoraproject:fedora:python-streamlink

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/24/2026

Vulnerability Publication Date: 9/23/2026

Reference Information

CVE: CVE-2026-92164