streamlink vulnerabilities

Products

• streamlink 2

Latest streamlink CVEs

Newest publication first

1. CVE-2026-92164 Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files

   Published 2026-09-23

   Medium·CVSS 6.5

   Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server c...

2. CVE-2026-44353 Streamlink: Arbitrary local file read via file:// URI in HLS and DASH

   Published 2026-05-27

   Medium·CVSS 6.5

   Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.4.0, Streamlink's HLS and DASH parsers do not validate the URI scheme of segment entries and other resources. A remote .m3u8 HLS playlist or .mpd DASH manifest can list fil...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.