openSUSE-SU-2026:21163-1
openSUSE-SU-2026:21163-1 · Security update for yt-dlp
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This update for yt-dlp fixes the following issues: Changes in yt-dlp: - Update to version 2026.06.09 * Fixed [CVE-2026-50019]: File Downloader cookie leak with curl * Fixed [CVE-2026-50023]: Dangerous file type creation via insufficient filename sanitization * Fixed [CVE-2026-50574]: Arbitrary code execution via manifest downloads with aria2c * Added lockfile and pinned extras * Removed url, desktop and webloc from safe extensions * Extract supplemental codecs from DASH manifests * abematv: Extract subtitles * ard: Support new ardsounds domain * monstercat: Support older URLs * pornhub: Support browser impersonation * reddit: Fix unauthenticated extraction * rtp: Support multi-part episodes and --no-playlist * s4c: Extract more metadata * soop: Adapt extractors to new domain * soundcloud: Support --extractor-retries for original formats * twitch: Remove dead rechat subtitles * twitter: Fix view_count extraction * external: aria2c: Remove support for m3u8/dash protocols * ffmpegmetadata: Avoid erroneous ISO 639 conversions
Fix available
- Published
- Updated
Stack: system
Affected products and versions
yt-dlp openSUSE:Leap 16.0
- Affected ranges
- ECOSYSTEM: < 2026.06.09-bp160.1.1
Update to 2026.06.09-bp160.1.1