CVE-2026-55404

HighCVSS 7.5

Published: 08/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.55%

42th percentile - higher than 42% of all known CVEs

Summary

In yt-dlp and youtube-dl prior to version 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping. This allows malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux, potentially leading to command execution when the generated shortcut is opened.

Risk Assessment

The organization faces a risk of remote code execution (RCE) on Windows and Linux workstations if a user opens a malicious shortcut file generated by the tool. An attacker could exploit this vulnerability to gain control of the system or steal data.

Recommendation

Immediately update yt-dlp to version 2026.7.4 or later. Avoid using the --write-link, --write-url-link, and --write-desktop-link options in older versions until the update is applied.

Other vulnerabilities in yt-dlp

CVE-2023-35934Medium
A vulnerability in yt-dlp allows for cookie leakage during file downloads, potentially leading to unauthorized access to data. The issue affects versions prior to 2023.07.06 and nightly builds before 2023.07.06.185519, except for `curl` and `httpie` version 3.1.0 or later.

Original NVD description (English source)

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.