yt-dlp-nightly
Last updated
A feature-rich command-line audio/video downloader.
Install with winget
$ winget install --id yt-dlp.yt-dlp.nightly --exact --version 2026.08.30.232658Run in Command Prompt, PowerShell, or Windows Terminal. Prompts for any agreements.
For Intune admins
Stop chasing app updates. Pckgr patches them for you.
Automated application patching for Microsoft Intune. Pckgr keeps a curated library of 1,000+ apps continuously up-to-date in your tenant via Microsoft Graph - no manual repackaging, no chasing vendor sites.
Start free 30-day trialNo credit card required.
About
The yt-dlp nightly channel builds.
yt-dlp is a feature-rich command-line audio/video downloader with support for thousands of sites.
The project is a fork of youtube-dl based on the now inactive youtube-dlc.
Installers · v2026.08.30.232658
Copy a command tailored to that specific architecture, type, and scope - useful when winget would otherwise pick a different default.
Security
11 known CVEs via NVD
yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validat...
yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary...
yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as .desktop, .url, .webloc) to the user's filesystem, bypassing the remediation for CVE-2024-38519. The...
yt-dlp is a command-line audio/video downloader. From 2023.09.24 until 2026.06.09, if curl is used as an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. A...
yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when yt-dlp's `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter) is used, an attacker could achieve arbitrary command injection on the user's sys...
yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option is used on Windows with the default placeholder (or {}), insufficient sanitization is applied to the expanded filepath, allowing for remote code execution. This...
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using `--exec` with `%q` by replacing double quotes with two double quotes. However, this escaping is not sufficient, and still allows expansion...
See a CVE that affects your fleet? Push the patched version to Intune in one click with Pckgr - automated patching is the only way to keep up.
Related apps
More from yt-dlp or browse audio, audio-downloader, download.
Frequently asked questions
How do I install yt-dlp-nightly on Windows?
How do I install yt-dlp-nightly silently for unattended deployment?
How do I uninstall yt-dlp-nightly via winget?
Is yt-dlp-nightly free?
Does yt-dlp-nightly work on Windows 10?
How do I keep yt-dlp-nightly up to date?
Recent versions
- 2026.08.30.232658latest
- 2026.08.04.234419
- 2026.07.23.234303
- 2026.07.21.234255
- 2026.07.14.233956
- 2026.07.12.233956
- 2026.07.09.234832
- 2026.07.06.234510
- 2026.07.02.234458
- 2026.06.30.234726