CVE-2023-35934

CVE-2023-35934 describes a cookie leakage vulnerability in yt-dlp, a command-line video downloader, affecting versions prior to 2023.07.06. This flaw allows sensitive cookies to be inadvertently sent to unintended hosts during HTTP redirects or when downloading fragmented content, potentially exposing user authentication information. Rated with a CVSS score of 8.2 (High), the vulnerability has a network attack vector and low attack complexity, requiring user interaction (e.g., clicking a malicious link) to trigger. Successful exploitation could lead to high confidentiality impact due to cookie exposure, but has low integrity and no availability impact. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness or immediate threat perception.