CVE-2023-35934 – yt-dlp File Downloader cookie leak

https://notcve.org/view.php?id=CVE-2023-35934

06 Jul 2023 — yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host. This vulnerable behavior is present in yt-dlp prior to 2023.07.06 and nightly 2023.07.06.185519. All native and external downloaders are affected, except for `curl` and `httpie` (version 3.1.0 or later). At the file... • https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2023.07.06.185519 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •