{"id":"openSUSE-SU-2026:22142-1","summary":"Security update for yt-dlp","details":"This update for yt-dlp fixes the following issues:\n\nChanges in yt-dlp:\n\nUpdate to version 2026.08.19:\n\n  * utils: float_or_none: Catch OverflowError\n  * americastestkitchen: Fix season/series extraction\n  * apple: Rework extractors\n  * ard: Remove dead extractor\n  * bandcamp: Support browser impersonation\n  * bfmtv: Fix extractor\n  * instagram: Fix logged-in extraction\n  * showroom: Rework extractors\n  * tiktok: Fix extractor\n  * tiktok: Fix formats extraction\n  * tiktok: Support share URLs\n  * twitter: broadcast: Fix events handling\n  * vimeo: Remove ios and macos clients\n  * whyp: Fix extractor\n  * youtube: Add visionos player client\n  * youtube: Add web_embedded client fallbacks\n  * youtube: Extract channel_follower_count for collaborators\n  * youtube: Fix live adaptive fragments generation\n  * youtube: Remove android_vr from default clients\n  * youtube: tab: Always extract channel metadata\n  * hls: Fix crash on empty fragment lists in tests\n\nUpdate to version 2026.07.04:\n\n  * The minimum recommended Python version has been raised to\n    3.11\n  * Security: [CVE-2026-55404 bsc#1286026] Downstream command injection via\n    improper sanitization of --write-link output\n  * Shortcut file data is now properly validated and sanitized\n    when the --write-link options are used\n  * Always include warnings in debug output\n  * Fix allow-unsafe-ext compat option\n  * Raise minimum recommended Python version to 3.11\n  * Validate and escape values in --write-link output\n  * cookies: Use ' instead of \" for SQL string quoting\n  * utils: Deprecate make_dir in favor of make_parent_dirs\n  * utils: HTTPHeaderDict: Fix __ior__\n  * utils: parse_duration: Return int when appropriate\n  * utils: parse_resolution: Support fps suffixes\n  * utils: pkcs1pad: Fix invalid PKCS#1 v1.5 padding bytes\n  * utils: qualities: Avoid repeated index lookups\n  * utils: random_user_agent: Bump version range 143-149 =\u003e\n    144-150\n  * Always include id in request error output\n  * Fix request logging\n  * arte: Fix playlist support\n  * bandcamp: weekly: Fix extractor\n  * bilibili: Fix API extraction\n  * instagram: Detect when cookies are invalidated\n  * instagram: Rework extractor\n  * linkedin: Remove broken login support\n  * mgtv: Fix VIP stream extraction\n  * mxplayer: Fix extractors\n  * mxplayer: Rework extractors\n  * niconico: Fix error detection\n  * niconico: Support shorts\n  * omnyfm: Add extractors\n  * openrec: Rework extractors\n  * patreon: Support new URL format\n  * peertube: Support password-protected videos\n  * periscope: Improve metadata extraction\n  * reddit: Remove broken login support\n  * soundcloud: Extract uploader_url for playlists\n  * soundcloud: Extract comments\n  * soundcloud: Improve metadata extraction\n  * streaks: Fix extractor\n  * svt: Fix extractor\n  * telewebion: Fix extractor\n  * trovo: Remove dead extractors\n  * truth: Support share URLs\n  * tviplayer: Fix extractor\n  * unsupported: Update unsupported sites\n  * wrestleuniverse: vod: Fix extractor\n  * youtube: Fix extract_relative_time for abbreviated units\n  * youtube: Fix detection of forced preroll wait time\n  * youtube: Fix minor issues\n  * youtube: Support live adaptive formats\n  * tab: Fix flat extraction of collaborators\n  * tab: Fix flat playlist metadata extraction\n  * tab: Fix metadata extraction\n  * tab: Fix pagination\n  * zan: Add extractor\n  * zdf: Detect livestreams\n  * zoom: clips: Add extractor\n  * external: Fix resuming downloads with aria2c\n  * external: curl: Support development versions\n  * mhtml: Fix storyboard content-length calculation\n  * build: Update 17 dependencies\n  * build: Update 6 dependencies\n  * cleanup: Fix invalid info dict fields\n  * cleanup: Fix minor mistakes\n  * cleanup: Remove RTSP and MMS support\n  * cleanup: Replace dead example/test URL\n  * cleanup: Miscellaneous: 997fa14\n  * docs: Make \"No AI / No LLM Policy\" abundantly clear\n","modified":"2026-10-22T17:23:12.289927508Z","published":"2026-10-20T15:47:33Z","related":["CVE-2026-55404"],"upstream":["CVE-2026-55404"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286026"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-55404"}],"affected":[{"package":{"name":"yt-dlp","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/yt-dlp&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.08.19-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"yt-dlp":"2026.08.19-bp160.1.1","yt-dlp-youtube-dl":"2026.08.19-bp160.1.1","python313-yt-dlp":"2026.08.19-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22142-1.json"}}],"schema_version":"1.9.0"}