CVE-2026-26331: yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

February 23, 2026 (updated February 24, 2026)

When yt-dlp’s --netrc-cmd command-line option (or netrc_cmd Python API parameter) is used, an attacker could achieve arbitrary command injection on the user’s system with a maliciously crafted URL.

References

github.com/advisories/GHSA-g3gw-q23r-pgqm
github.com/yt-dlp/yt-dlp
github.com/yt-dlp/yt-dlp/commit/1fbbe29b99dc61375bf6d786f824d9fcf6ea9c1a
github.com/yt-dlp/yt-dlp/releases/tag/2026.02.21
github.com/yt-dlp/yt-dlp/security/advisories/GHSA-g3gw-q23r-pgqm
nvd.nist.gov/vuln/detail/CVE-2026-26331

Code Behaviors & Features

Detect and mitigate CVE-2026-26331 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →