yt-dlp — security advisory
yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external downloaders are affected, except for `curl` and `httpie` (version 3.1.0 or later). At the file download stage, all cookies are passed by yt-dlp to the file downloader as a `Cookie` header, thereby losing their scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped. yt-dlp version 2023.07.06 and nightly 2023.07.06.185519 fix this issue by removing the `Cookie` header upon HTTP redirects; having native downloaders calculate the `Cookie` header from the cookiejar, utilizing external downloaders' built-in support for cookies instead of passing them as header arguments, disabling HTTP redirectiong if the external downloader does not have proper cookie support, processing cookies passed as HTTP headers to limit their scope, and having a separate field for cookies in the info dict storing more information about scoping Some workarounds are available for those who are unable to upgrade. Avoi
- Products
- yt-dlp
- Affected versions
- 2021.12.01-1, 2021.12.27-1, 2022.01.21-1, 2022.02.04-1, 2022.03.08.1-1, 2022.04.08-1, 2023.07.06-1, 2023.10.13-1ubuntu1, 2023.11.16-1, 2023.12.30-1ubuntu1, 2024.03.10-1, 2024.04.09-1, 2025.03.27-1, 2025.04.30-1, 2025.05.22-1, 2025.06.09-1, 2025.06.25-1, 2025.06.30-1, 2025.07.21-1, 2025.08.11-1, 2025.08.20-1, 2025.08.22-1, 2025.08.27-1, 2025.09.05-1, 2025.09.23-1, 2025.10.22-1, 2025.11.12-1, 2025.12.08-1, 2026.01.31-1, 2026.03.17-1, 2026.06.09-1, 2026.07.04-1, 2026.08.19-1
- Fixed versions
- Not specified
- CVEs
- CVE-2023-35934
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 01:42 UTC · Revision 1
Source evidence
yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external downloaders are affected, except for `curl` and `httpie` (version 3.1.0 or later). At the file download stage, all cookies are passed by yt-dlp to the file downloader as a `Cookie` header, thereby losing their scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped. yt-dlp version 2023.07.06 and nightly 2023.07.06.185519 fix this issue by removing the `Cookie` header upon HTTP redirects; having native downloaders calculate the `Cookie` header from the cookiejar, utilizing external downloaders' built-in support for cookies instead of passing them as header arguments, disabling HTTP redirectiong if the external downloader does not have proper cookie support, processing cookies passed as HTTP headers to limit their scope, and having a separate field for cookies in the info dict storing more information about scoping Some workarounds are available for those who are unable to upgrade. Avoi
osv:UBUNTU-CVE-2023-35934
yt-dlp
Fixed versions: Not specified
yt-dlp
Fixed versions: Not specified
yt-dlp
Fixed versions: Not specified
yt-dlp
Fixed versions: Not specified
yt-dlp
Fixed versions: Not specified
Complete source record
{
"id": "ddaba42279d9fff051f6c58b60413c8aedc080936a79474789d106f719f8d79a",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2023-35934",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2023-35934",
"summary": "yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external downloaders are affected, except for `curl` and `httpie` (version 3.1.0 or later). At the file download stage, all cookies are passed by yt-dlp to the file downloader as a `Cookie` header, thereby losing their scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped. yt-dlp version 2023.07.06 and nightly 2023.07.06.185519 fix this issue by removing the `Cookie` header upon HTTP redirects; having native downloaders calculate the `Cookie` header from the cookiejar, utilizing external downloaders' built-in support for cookies instead of passing them as header arguments, disabling HTTP redirectiong if the external downloader does not have proper cookie support, processing cookies passed as HTTP headers to limit their scope, and having a separate field for cookies in the info dict storing more information about scoping Some workarounds are available for those who are unable to upgrade. Avoi",
"evidence": "osv:UBUNTU-CVE-2023-35934",
"products": [
{
"name": {
"value": "yt-dlp",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2021.12.01-1",
"evidence": "/affected/0/versions"
},
{
"value": "2021.12.27-1",
"evidence": "/affected/0/versions"
},
{
"value": "2022.01.21-1",
"evidence": "/affected/0/versions"
},
{
"value": "2022.02.04-1",
"evidence": "/affected/0/versions"
},
{
"value": "2022.03.08.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "2022.04.08-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "yt-dlp",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2023.07.06-1",
"evidence": "/affected/1/versions"
},
{
"value": "2023.10.13-1ubuntu1",
"evidence": "/affected/1/versions"
},
{
"value": "2023.11.16-1",
"evidence": "/affected/1/versions"
},
{
"value": "2023.12.30-1ubuntu1",
"evidence": "/affected/1/versions"
},
{
"value": "2024.03.10-1",
"evidence": "/affected/1/versions"
},
{
"value": "2024.04.09-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "yt-dlp",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2025.03.27-1",
"evidence": "/affected/2/versions"
},
{
"value": "2025.04.30-1",
"evidence": "/affected/2/versions"
},
{
"value": "2025.05.22-1",
"evidence": "/affected/2/versions"
},
{
"value": "2025.06.09-1",
"evidence": "/affected/2/versions"
},
{
"value": "2025.06.25-1",
"evidence": "/affected/2/versions"
},
{
"value": "2025.06.30-1",
"evidence": "/affected/2/versions"
},
{
"value": "2025.07.21-1",
"evidence": "/affected/2/versions"
},
{
"value": "2025.08.11-1",
"evidence": "/affected/2/versions"
},
{
"value": "2025.08.20-1",
"evidence": "/affected/2/versions"
},
{
"value": "2025.08.22-1",
"evidence": "/affected/2/versions"
},
{
"value": "2025.08.27-1",
"evidence": "/affected/2/versions"
},
{
"value": "2025.09.05-1",
"evidence": "/affected/2/versions"
},
{
"value": "2025.09.23-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "yt-dlp",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2026.03.17-1",
"evidence": "/affected/3/versions"
},
{
"value": "2026.06.09-1",
"evidence": "/affected/3/versions"
},
{
"value": "2026.07.04-1",
"evidence": "/affected/3/versions"
},
{
"value": "2026.08.19-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "yt-dlp",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2025.09.23-1",
"evidence": "/affected/4/versions"
},
{
"value": "2025.10.22-1",
"evidence": "/affected/4/versions"
},
{
"value": "2025.11.12-1",
"evidence": "/affected/4/versions"
},
{
"value": "2025.12.08-1",
"evidence": "/affected/4/versions"
},
{
"value": "2026.01.31-1",
"evidence": "/affected/4/versions"
},
{
"value": "2026.03.17-1",
"evidence": "/affected/4/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2023-35934",
"aliases": [
"UBUNTU-CVE-2023-35934"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "yt-dlp",
"purl": "pkg:deb/ubuntu/yt-dlp?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"2021.12.01-1",
"2021.12.27-1",
"2022.01.21-1",
"2022.02.04-1",
"2022.03.08.1-1",
"2022.04.08-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-35934.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "yt-dlp",
"binary_version": "2022.04.08-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "yt-dlp",
"purl": "pkg:deb/ubuntu/yt-dlp?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"2023.07.06-1",
"2023.10.13-1ubuntu1",
"2023.11.16-1",
"2023.12.30-1ubuntu1",
"2024.03.10-1",
"2024.04.09-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-35934.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "yt-dlp",
"binary_version": "2024.04.09-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "yt-dlp",
"purl": "pkg:deb/ubuntu/yt-dlp?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"2025.03.27-1",
"2025.04.30-1",
"2025.05.22-1",
"2025.06.09-1",
"2025.06.25-1",
"2025.06.30-1",
"2025.07.21-1",
"2025.08.11-1",
"2025.08.20-1",
"2025.08.22-1",
"2025.08.27-1",
"2025.09.05-1",
"2025.09.23-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-35934.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "yt-dlp",
"binary_version": "2025.09.23-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "yt-dlp",
"purl": "pkg:deb/ubuntu/yt-dlp?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"2026.03.17-1",
"2026.06.09-1",
"2026.07.04-1",
"2026.08.19-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-35934.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "yt-dlp",
"binary_version": "2026.08.19-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "yt-dlp",
"purl": "pkg:deb/ubuntu/yt-dlp?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"2025.09.23-1",
"2025.10.22-1",
"2025.11.12-1",
"2025.12.08-1",
"2026.01.31-1",
"2026.03.17-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2023/UBUNTU-CVE-2023-35934.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "yt-dlp",
"binary_version": "2026.03.17-1"
}
]
}
}
],
"modified": "2026-10-17T12:57:20.146910832Z",
"provider": "osv",
"upstream": [
"CVE-2023-35934"
],
"references": [
"https://ubuntu.com/security/CVE-2023-35934",
"https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2023.07.06.185519",
"https://github.com/yt-dlp/yt-dlp/commit/3121512228487c9c690d3d39bfd2579addf96e07",
"https://github.com/yt-dlp/yt-dlp/commit/f8b4bcc0a791274223723488bfbfc23ea3276641",
"https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-v8mc-9377-rwjj",
"https://github.com/yt-dlp/yt-dlp/commit/1ceb657bdd254ad961489e5060f2ccc7d556b729",
"https://github.com/yt-dlp/yt-dlp/releases/tag/2023.07.06",
"https://www.cve.org/CVERecord?id=CVE-2023-35934"
]
},
"related_cves": [
{
"value": "CVE-2023-35934",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/1/score"
},
"source_id": "core-osv",
"document_id": 357223,
"published_at": "2023-07-06T20:15:00+00:00"
}