openSUSE-SU-2026:21163-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21163-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/openSUSE-SU-2026:21163-1
Upstream
Related
Published
2026-06-29T08:10:11Z
Modified
2026-06-30T18:24:49Z
Summary
Security update for yt-dlp
Details

This update for yt-dlp fixes the following issues:

Changes in yt-dlp:

  • Update to version 2026.06.09
    • Fixed [CVE-2026-50019]: File Downloader cookie leak with curl
    • Fixed [CVE-2026-50023]: Dangerous file type creation via insufficient filename sanitization
    • Fixed [CVE-2026-50574]: Arbitrary code execution via manifest downloads with aria2c
    • Added lockfile and pinned extras
    • Removed url, desktop and webloc from safe extensions
    • Extract supplemental codecs from DASH manifests
    • abematv: Extract subtitles
    • ard: Support new ardsounds domain
    • monstercat: Support older URLs
    • pornhub: Support browser impersonation
    • reddit: Fix unauthenticated extraction
    • rtp: Support multi-part episodes and --no-playlist
    • s4c: Extract more metadata
    • soop: Adapt extractors to new domain
    • soundcloud: Support --extractor-retries for original formats
    • twitch: Remove dead rechat subtitles
    • twitter: Fix view_count extraction
    • external: aria2c: Remove support for m3u8/dash protocols
    • ffmpegmetadata: Avoid erroneous ISO 639 conversions
References

Affected packages

openSUSE:Leap 16.0 / yt-dlp

Package

Name
yt-dlp
Purl
pkg:rpm/opensuse/yt-dlp&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2026.06.09-bp160.1.1

Ecosystem specific 

{
    "binaries":  [
        {
            "python313-yt-dlp":  "2026.06.09-bp160.1.1",
            "yt-dlp":  "2026.06.09-bp160.1.1",
            "yt-dlp-youtube-dl":  "2026.06.09-bp160.1.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21163-1.json"