Advisories for Pypi/Streamlink package

HTTPSession mounts a FileAdapter for the file:// scheme and inherits redirect handling unchanged from requests.Session. requests does not check for scheme downgrades or cross-protocol transitions when it follows a redirect, so any http(s) request Streamlink makes can be redirected by the remote server into file:///… and the local file is returned as the response body. GHSA-hgqw-6m45-hw5f / CVE-2026-44353 fixed direct file:// segment and playlist URIs in HLS playlists and DASH …

Streamlink's HLS and DASH parsers do not validate the URI scheme of segment entries and other resources. A remote .m3u8 HLS playlist or .mpd DASH manifest can list file:///path/to/file as a segment, and streamlink will read that local file and write its contents to the output stream. Confirmed on streamlink 8.3.0 (latest release at time of report).