6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-50019

CVE-2026-50019: yt-dlp: File Downloader cookie leak with curl

yt-dlp is a command-line audio/video downloader. From 2023.09.24 until 2026.06.09, if curl is used as an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. At the file download stage, the cookies are passed by yt-dlp to the file downloader via --cookie. However, unless these are loaded from a file, this operation does not activate the cookie engine. As a result, curl will send cookies with requests to domains or paths for which the cookies are not scoped. This vulnerability is fixed in 2026.06.09.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-50019

CVE-2026-50019:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
yt-dlp	pip	>= 2023.9.24, < 2026.6.9	2026.6.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security advisory and the associated patch commit 2726572520238356bcf64aba2040228648b44c82 points directly to the _make_cmd method within the CurlFD class in yt_dlp/downloader/external.py as the source of the vulnerability. The vulnerability description explains that passing cookies as a simple header to curl (e.g., --cookie "key=value") causes them to be leaked on redirects. The patch removes this exact logic:

-        cookie_header = self.ydl.cookiejar.get_cookie_header(info_dict['url'])
-        if cookie_header:
-            cmd += ['--cookie', cookie_header]

This code snippet is replaced with a more secure mechanism that instructs curl to use its cookie engine by either reading cookies from stdin (--cookie -) or from a temporary file. This ensures that cookies are only sent to the domains for which they are scoped. Therefore, the CurlFD._make_cmd function is the precise location of the vulnerable code that constructs the insecure command, making it the key function that would be observed in a runtime profile when the vulnerability is triggered.

Vulnerable functions

CurlFD._make_cmd

yt_dlp/downloader/external.py

The vulnerability lies in how the `_make_cmd` function in the `CurlFD` class constructs the command for the `curl` downloader. The original code extracted cookies as a raw header string and passed them to `curl` using the `--cookie` argument. This method bypasses `curl`'s cookie engine, causing `curl` to send the cookies to any domain upon an HTTP redirect, which leads to the cookie leak.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.