The flaw occurs when yt‑dlp invokes curl as an external downloader. yt‑dlp passes user cookies via the --cookie option, but curl only activates its cookie engine if the cookies are read from a file. Because yt‑dlp supplies the cookies directly, curl sends them with every request, regardless of target domain or path. Cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest. This results in the disclosure of session cookies to unintended or malicious domains. The fix was released in version 2026.06.09.

yt‑dlp command‑line downloader from release 2023.09.24 until 2026.06.09 includes the fix that properly scopes cookies when using curl. No other vendors are affected.

The CVSS score of 6.1 indicates moderate severity. The EPSS score is not available, so the likelihood of exploitation is unknown, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need access to a user’s environment or could supply a malicious download manifest that forces curl to send requests to a malicious host, resulting in cookie leakage. The risk is limited to confidentiality through unintended cookie leakage, and no integrity or availability impact is noted. Updating to a fixed version is the recommended mitigation.