CVE-2026-55404 yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
Attackers can inject malicious commands via crafted metadata in yt-dlp shortcut files, leading to code execution when opened.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-55404?
CVE-2026-55404 is a high-severity command injection vulnerability in yt-dlp, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.
Weakness: CWE-74
Which versions are affected by CVE-2026-55404?
3 open source packages ship an affected version, including yt-dlp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
yt-dlp PyPI | All versions | 2026.7.4 |
yt-dlp PyPI | All versions | 2026.7.4 |
yt-dlp PyPI | All versions | 2026.7.4 |
Linux distribution packages (2)
yt-dlp openSUSE:Leap 16.0 | All versions | 2026.08.19-bp160.1.1 |
yt-dlp openSUSE:Tumbleweed | All versions | 2026.07.04-1.1 |
Products include Yt-Dlp Project Yt-Dlp.
How do I fix CVE-2026-55404?
Upgrade yt-dlp to 2026.7.4 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-55404 being exploited?
There is no known exploitation of CVE-2026-55404 in the wild and no public exploit code.
Other vulnerabilities in yt-dlp
- CVE-2026-26331 yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option
- CVE-2024-22423 yt-dlp `--exec` command injection when using `%q` in yt-dlp on Windows
- CVE-2023-40581 yt-dlp command injection when using `%q` in `--exec` on Windows
- CVE-2026-50023 yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)
- CVE-2026-50574 yt-dlp: Arbitrary code execution via manifest downloads with aria2c
Sources
Also known as DEBIAN-CVE-2026-55404, GHSA-6v4j-43gg-vj32, PYSEC-2026-3622, UBUNTU-CVE-2026-55404, openSUSE-SU-2026:11196-1, openSUSE-SU-2026:22142-1.