CVE-2026-55404
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
CVSS Score
7.5
EPSS Score
0.6%
EPSS Percentile
42th
yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.
| CWE | CWE-74 |
| Vendor | yt-dlp |
| Product | yt-dlp |
| Published | Jul 8, 2026 |
| Last Updated | Jul 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for yt-dlp yt-dlp
Be the first to know when new high vulnerabilities affecting yt-dlp yt-dlp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
yt-dlp / yt-dlp
< 2026.7.4