What’s Vulnerable › Vulnerabilities

CVE-2026-55404: yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-08 · updated 2026-07-13
• Weakness: CWE-74

Description

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.

Affected products

• yt-dlp: before 2026.07.04 — fixed in 2026.07.04

How to fix

Upgrade to a fixed version: yt-dlp 2026.07.04. Check the vendor advisory for mitigations.

References

• https://github.com/yt-dlp/yt-dlp/commit/b6590aaa1e3808155d69c9a79a797ae484163789
• https://github.com/yt-dlp/yt-dlp/releases/tag/2026.07.04
• https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-6v4j-43gg-vj32

Get alerted when CVE-2026-55404 or the next vulnerability affects your stack