CVE-2026-55404 Details
Description
yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.
A command injection vulnerability has been identified in yt-dlp and youtube-dl, two command-line audio/video downloaders. This issue affects versions prior to 2026.7.4. The vulnerability arises from the improper validation and escaping of metadata used to create shortcut files (.url or .desktop) through the --write-link, --write-url-link, and --write-desktop-link options. On Windows, this flaw allows the injection of malicious file:// URIs that could execute commands if the shortcut is opened. On Linux, it enables the injection of newline-based metadata into desktop entry files, which could also result in command execution.
Users are advised to upgrade to yt-dlp version 2026.07.04 or later. Instructions for downloading the latest version are available on the yt-dlp GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/yt-dlp/yt-dlp/commit/b6590aaa1e3808155d69c9a79a797ae484163789 | [email protected] | Patch |
| https://github.com/yt-dlp/yt-dlp/releases/tag/2026.07.04 | [email protected] | ProductRelease Notes |
| https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-6v4j-43gg-vj32 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| yt-dlp project yt-dlp | < 2026.07.04 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | Initial Analysis | [email protected] |
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |