nicolaasjan/yt-dlp 2026.06.10.041924

on GitHub

A description of the various files is in the README

The zipimport Unix executable contains code licensed under ISC and MIT. The PyInstaller-bundled executables are subject to these and other licenses, all of which are compiled in THIRD_PARTY_LICENSES.txt

Important changes

• The minimum supported versions of Deno, Node, and Bun have been raised.
  The minimum required version of Deno is now v2.3.0; supported Node versions are v22 and up; Bun support has been deprecated and limited to versions 1.2.11 through 1.3.14.
• Security
  • Usage of vulnerable conversions (e.g. %()s) with the --exec option is an all-too-common pitfall. To remedy this, --exec now only allows safe conversions in its command templates.
    • Most users can simply replace %(...)s with %(...)q in their --exec argument(s). Numeric conversions are unaffected by this change. Using unsafe conversions with --exec poses a significant security risk. Read more
  • [CVE-2026-50019] File Downloader cookie leak with curl
    • Impact is limited to users of --downloader curl; cookies are now properly passed to curl so that it respects their scope
  • [CVE-2026-50023] Dangerous file type creation via insufficient filename sanitization
    • Writing files with the extensions .desktop, .url, or .webloc is now only allowed in the context of --write-link functionality
  • [CVE-2026-50574] Arbitrary code execution via manifest downloads with aria2c
    • Impact is limited to users of --downloader aria2c
    • Support for downloading HLS and DASH formats with aria2c has been removed. Users affected by this change should migrate to use -N for concurrent fragment downloads via the native downloader