CVE-2023-46121 Generic Extractor MITM Vulnerability in yt-dlp
An attacker can force yt-dlp to use an arbitrary proxy, enabling Man-in-the-Middle attacks and potential cookie exfiltration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-46121?
CVE-2023-46121 is a medium-severity server-side request forgery vulnerability in yt-dlp, published on 14 Nov 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP session. This could lead to cookie exfiltration in some cases. Version 2023.11.14 removed the ability to smuggle `http_headers` to the Generic extractor, as well as other extractors that use the same pattern. Users are advised to upgrade. Users unable to upgrade should disable the Ggneric extractor (or only pass trusted sites with trusted content) and ake caution when using `--no-check-certificate`.
Weakness: CWE-444
Which versions are affected by CVE-2023-46121?
3 open source packages ship an affected version, including yt-dlp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
yt-dlp PyPI | From 2022.10.04 | 2023.11.14 |
yt-dlp PyPI | From 2022.10.04 | 2023.11.14 |
yt-dlp PyPI | From 2022.10.04 | 2023.11.14 |
Linux distribution packages (1)
yt-dlp openSUSE:Tumbleweed | All versions | 2023.11.16-1.1 |
Products include Yt-Dlp Project Yt-Dlp.
How do I fix CVE-2023-46121?
Upgrade yt-dlp to 2023.11.14 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2023-46121 being exploited?
There is no known exploitation of CVE-2023-46121 in the wild and no public exploit code.
Other vulnerabilities in yt-dlp
- CVE-2026-26331 yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
- CVE-2024-22423 yt-dlp `--exec` command injection when using `%q` in yt-dlp on Windows
- CVE-2023-40581 yt-dlp command injection when using `%q` in `--exec` on Windows
- CVE-2026-50023 yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
- CVE-2026-50574 yt-dlp: Arbitrary code execution via manifest downloads with aria2c
Sources
Also known as DEBIAN-CVE-2023-46121, GHSA-3ch3-jhc6-5r8x, PYSEC-2026-2063, UBUNTU-CVE-2023-46121, openSUSE-SU-2024:13435-1.