Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
HTTPSession mounts a FileAdapter for the file:// scheme and inherits redirect handling unchanged from requests.Session. requests does not check for scheme downgrades or cross-protocol transitions when it follows a redirect, so any http(s) request Streamlink makes can be redirected by the remote server into file:///... and the local file is returned as the response body. GHSA-hgqw-6m45-hw5f / CVE-2026-44353 fixed direct file:// segment and playlist URIs in HLS playlists and DASH manifests. Those checks look at the URL as it appears in the manifest, so a manifest that lists an ordinary https:// URL passes them, and the redirect happens later at fetch time. The attack surface is the same one that advisory describes, but the flaw is one level down in HTTPSession rather than in the streaming implementations, so it applies to every request the session makes and not only to segment and manifest fetches. Affected version Executed against released streamlink 8.5.0 (PyPI, installed…
Recommended action: Upgrade to 8.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Streamlink's HLS and DASH parsers do not validate the URI scheme of segment entries and other resources. A remote .m3u8 HLS playlist or .mpd DASH manifest can list file:///path/to/file as a segment, and streamlink will read that local file and write its contents to the output stream. Confirmed on streamlink 8.3.0 (latest release at time of report). Description Segment URIs from an HLS playlist or DASH manifest are passed to the worker without any scheme check. The underlying HTTP session accepts file:// URIs, which resolve against the local filesystem. There is no scheme allowlist at the parser level, so any path readable by the streamlink process is treated as a valid segment. The attacker does not need local access to the victim. A playlist/manifest hosted on an attacker-controlled server, fetched by streamlink on the victim's machine, is enough to trigger the read. Impact A remote attacker hosting a malicious playlist/manifest can make any client running streamlink against…
Recommended action: Upgrade to 8.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.