github.com/ytdl-org/youtube-dl
Submitted 8/4/2026, 10:25:52 AM · Status: ok
Risk grade
F
100 / 100
Findings
93
0 critical51 high42 medium0 low0 info0 on CISA KEV0ATT&CK
Showing 93 of 93 findings
Findings
- Detected algolia-api-key: Identified an Algolia API Key, which could result in unauthorized search operations and data exposure on Algolia-managed platformsIdentified an Algolia API Key, which could result in unauthorized search operations and data exposure on Algolia-managed platforms.gitleaks
- Detected aws-access-token: Identified a pattern that may indicate AWS credentials, risking unauthorized cloud resource access and data breaches on AWS platformsIdentified a pattern that may indicate AWS credentials, risking unauthorized cloud resource access and data breaches on AWS platforms.gitleaks
- Detected gcp-api-key: Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breachesUncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operationsDetected a Generic API Key, potentially exposing access to various services and sensitive operations.gitleaks
- Detected jwt: Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user dataUncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.gitleaks
- Detected private-key: Identified a Private Key, which may compromise cryptographic security and sensitive data encryptionIdentified a Private Key, which may compromise cryptographic security and sensitive data encryption.gitleaks
- Hardcoded JSON Web Token (a "eyJ...eyJ...sig" literal). A committed JWT is a live bearer credential until it expires — anyone with repo read access can replay it. Remove it, rotate/revoke the token, aHardcoded JSON Web Token (a "eyJ...eyJ...sig" literal). A committed JWT is a live bearer credential until it expires — anyone with repo read access can replay it. Remove it, rotate/revoke the token, and inject tokens at runtime. (First-party socbox rule; Apache-2.0.)semgrepyoutube_dl/extractor/adultswim.py:159
- subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list ansubprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)semgrepyoutube_dl/postprocessor/execafterdownload.py:26
- The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(CI)checkov.github/workflows/ci.yml:34
- hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)semgrepyoutube_dl/extractor/anvato.py:28
- hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)semgrepyoutube_dl/extractor/bilibili.py:169
- hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)semgrepyoutube_dl/extractor/common.py:781
- hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)semgrepyoutube_dl/extractor/crunchyroll.py:299
- hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)semgrepyoutube_dl/extractor/douyutv.py:98
- hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)semgrepyoutube_dl/extractor/fc2.py:93
- hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)semgrepyoutube_dl/extractor/globo.py:149
- hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)semgrepyoutube_dl/extractor/instagram.py:329
- hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)semgrepyoutube_dl/extractor/iqiyi.py:26
- hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)semgrepyoutube_dl/extractor/jamendo.py:58
- hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)semgrepyoutube_dl/extractor/kankan.py:8
- hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)semgrepyoutube_dl/extractor/leeco.py:300
- hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)semgrepyoutube_dl/extractor/neteasemusic.py:45
- hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)semgrepyoutube_dl/extractor/neteasemusic.py:74
- hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)semgrepyoutube_dl/extractor/nexx.py:358
- hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)semgrepyoutube_dl/extractor/prosiebensat1.py:48
- hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)semgrepyoutube_dl/extractor/prosiebensat1.py:59
- hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)semgrepyoutube_dl/extractor/prosiebensat1.py:83
- hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)semgrepyoutube_dl/extractor/prosiebensat1.py:102
- hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)semgrepyoutube_dl/extractor/yahoo.py:558
- hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)semgrepyoutube_dl/extractor/yandexmusic.py:152
- hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)hashlib.md5/sha1 is broken for security use. Use sha256+ or a password KDF (bcrypt/scrypt/argon2). (Apache-2.0.)semgrepyoutube_dl/extractor/youtube.py:440
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepyoutube_dl/extractor/aenetworks.py:26
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepyoutube_dl/extractor/anvato.py:206
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepyoutube_dl/extractor/bitchute.py:104
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepyoutube_dl/extractor/canvas.py:262
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepyoutube_dl/extractor/cbc.py:223
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepyoutube_dl/extractor/fox.py:55
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepyoutube_dl/extractor/gbnews.py:66
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepyoutube_dl/extractor/imggaming.py:19
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepyoutube_dl/extractor/moevideo.py:20
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepyoutube_dl/extractor/nationalgeographic.py:82
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepyoutube_dl/extractor/prosiebensat1.py:381
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepyoutube_dl/extractor/scrippsnetworks.py:52
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepyoutube_dl/extractor/shahid.py:23
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepyoutube_dl/extractor/soundcloud.py:516
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepyoutube_dl/extractor/vevo.py:178
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepyoutube_dl/extractor/videa.py:94
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepyoutube_dl/extractor/videomore.py:123
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepyoutube_dl/extractor/videomore.py:129
- Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)semgrepyoutube_dl/extractor/viki.py:26
This report is public.