A critical command injection vulnerability in yt-dlp, caused by improper handling of the --netrc-cmd parameter, poses a severe risk of full system compromise for affected users.

The software fails to properly sanitize inputs when the --netrc-cmd command-line option is active, allowing an unauthenticated attacker to inject arbitrary system commands through a crafted URL, which can be delivered via HTTP redirect.

This vulnerability carries a CVSS score of 8.8, reflecting its high potential for total system compromise. A successful exploit allows an attacker to achieve remote code execution on the host machine, potentially leading to unauthorized data access, the installation of persistent malware, and complete loss of system integrity.

Immediate Action: Update the yt-dlp package to version 2026.02.21 or later, which includes mandatory validation for netrc machine values.

Proactive Monitoring: Audit system logs for any unexpected process executions originating from the yt-dlp utility and monitor for unusual network traffic patterns associated with automated download tasks.

Compensating Controls: Users unable to apply the update immediately must disable the --netrc-cmd command-line option and the corresponding netrc_cmd Python API parameter to eliminate the attack vector.

Public Exploit Available: Yes — a public proof-of-concept repository has been identified at github.com/dxlerYT/CVE-2026-26331.

Given the availability of a public proof-of-concept and the high-impact nature of command injection, users must prioritize upgrading to version 2026.02.21. Organizations relying on yt-dlp for automated pipelines should conduct an immediate review of their configuration files to ensure that the --netrc-cmd option is not being utilized unnecessarily, as this remains the primary trigger for the vulnerability.