yt-dlp up to 2026.7.3 Shortcut Files .desktop webpage_url/filename injection

Summaryinfo

A vulnerability classified as critical has been found in yt-dlp up to 2026.7.3. This issue affects some unknown processing of the file .desktop of the component Shortcut Files. This manipulation of the argument webpage_url/filename causes injection. This vulnerability appears as CVE-2026-55404. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in yt-dlp up to 2026.7.3. It has been declared as critical. Affected by this vulnerability is some unknown processing of the file .desktop of the component Shortcut Files. The manipulation of the argument webpage_url/filename with an unknown input leads to a injection vulnerability. The CWE definition for the vulnerability is CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-55404 since 06/16/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1055 according to MITRE ATT&CK.

Upgrading to version 2026.7.4 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Data Loss Prevention Software

Name

• yt-dlp

Version

• 2026.7.0
• 2026.7.1
• 2026.7.2
• 2026.7.3

Website

• Product: https://github.com/yt-dlp/yt-dlp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion