yt-dlp (pypi) has 12 known vulnerabilities, the worst rated HIGH. Upgrade to 2026.7.4 or later to clear all of them. No malicious-package signal is recorded.
If the --write-link, --write-url-link or --write-desktop-link options are used with yt-dlp, it may produce output that can lead to downstream remote code…
CyberXYZ does not call a package safe in absolute terms. It records 12 known vulnerabilities for yt-dlp (pypi), the worst rated HIGH, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does yt-dlp have known vulnerabilities?
Yes. CyberXYZ records 12 known vulnerabilities for yt-dlp (pypi), the worst rated HIGH. These include GHSA-6v4j-43gg-vj32, GHSA-c6mh-fpjc-4pr3, GHSA-vx4q-3cr2-7cg2, GHSA-69qj-pvh9-c5wg, GHSA-g3gw-q23r-pgqm.
Which version of yt-dlp should I use?
2026.7.4 or later clears every advisory recorded for yt-dlp (pypi). Check the release you pick before installing it.
How do I check yt-dlp before installing?
Search yt-dlp in CyberXYZ Check at https://cyberxyz.io/check?q=yt-dlp. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 13:51 UTC. The most recent advisory here was published 2026-07-24. Updated continuously from NVD, GHSA, OSV and CNA feeds.