Vulnerability	Vulnerable Version
H Incorrect Resource Transfer Between Spheres youtube_dl is a YouTube video downloader Affected versions of this package are vulnerable to Incorrect Resource Transfer Between Spheres via improper file extension sanitization, which could create arbitrary filenames in the download folder (and path traversal on Windows). An attacker can modify the file system and execute arbitrary code by crafting malicious filenames that bypass security checks. How to fix Incorrect Resource Transfer Between Spheres? A fix was pushed into the `master` branch but not yet published.	[2015.01.25,)
M Information Exposure youtube_dl is a YouTube video downloader Affected versions of this package are vulnerable to Information Exposure. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. How to fix Information Exposure? There is no fixed version for `youtube_dl`.	[2015.01.25,)

Incorrect Resource Transfer Between Spheres

youtube_dl is a YouTube video downloader

Affected versions of this package are vulnerable to Incorrect Resource Transfer Between Spheres via improper file extension sanitization, which could create arbitrary filenames in the download folder (and path traversal on Windows). An attacker can modify the file system and execute arbitrary code by crafting malicious filenames that bypass security checks.

How to fix Incorrect Resource Transfer Between Spheres?

A fix was pushed into the master branch but not yet published.

[2015.01.25,)

Information Exposure

youtube_dl is a YouTube video downloader

Affected versions of this package are vulnerable to Information Exposure. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host.

How to fix Information Exposure?

There is no fixed version for youtube_dl.

[2015.01.25,)

Go back to all versions of this package