CVE-2023-46121

yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP session. This could lead to cookie exfiltration in some cases. Version 2023.11.14 removed the ability to smuggle `http_headers` to the Generic extractor, as well as other extractors that use the same pattern. Users are advised to upgrade. Users unable to upgrade should disable the Ggneric extractor (or only pass trusted sites with trusted content) and ake caution when using `--no-check-certificate`.

• CWE-444

• https://github.com/yt-dlp/yt-dlp/commit/f04b5bedad7b281bee9814686bba1762bae092ebPatch
• https://github.com/yt-dlp/yt-dlp/releases/tag/2023.11.14Release Notes
• https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-3ch3-jhc6-5r8xVendor Advisory
• https://github.com/yt-dlp/yt-dlp/commit/f04b5bedad7b281bee9814686bba1762bae092ebPatch
• https://github.com/yt-dlp/yt-dlp/releases/tag/2023.11.14Release Notes
• https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-3ch3-jhc6-5r8xVendor Advisory

Published

Nov 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46116Tutanota (Tuta Mail) is an encrypted email provider. Tutanot…8.8
• CVE-2023-46117reconFTW is a tool designed to perform automated recon on a …8.8
• CVE-2023-46118RabbitMQ is a multi-protocol messaging and streaming broker.…4.9
• CVE-2023-46119Parse Server is an open source backend that can be deployed …7.5
• CVE-2023-4612Improper Authentication vulnerability in Apereo CAS in jakar…9.8
• CVE-2023-46120The RabbitMQ Java client library allows Java and JVM-based a…7.5
• CVE-2023-46122sbt is a build tool for Scala, Java, and others. Given a spe…7.1
• CVE-2023-46123jumpserver is an open source bastion machine, professional o…5.3
• CVE-2023-46124Fides is an open-source privacy engineering platform for man…7.2
• CVE-2023-46125Fides is an open-source privacy engineering platform for man…6.5
• CVE-2023-46126Fides is an open-source privacy engineering platform for man…5.4
• CVE-2023-46127Frappe is a full-stack web application framework that uses P…5.4