CVE-2026-55404: yt-dlp Command Injection via Malicious Shortcut Metadata

Technical summary

The vulnerability stems from insufficient input validation and output encoding when yt-dlp and youtube-dl generate .url (Windows) or .desktop (Linux) shortcut files. The tools accept webpage_url and filename metadata from video sources without sanitizing or escaping these values before writing them into shortcut file formats. On Windows, an attacker can inject file:// protocol handlers that execute arbitrary code when the .url shortcut is opened. On Linux, newline characters can be injected into desktop entry key-value pairs, allowing injection of additional commands via the Exec or other executable fields. The attack requires user interaction (opening the generated shortcut) but is practical given how often users interact with downloaded content and auto-generated convenience files.

Business impact

For organizations or individuals using yt-dlp or youtube-dl in automated workflows, this vulnerability poses a code execution risk if downloaded video metadata is malicious. Media teams, content archivists, security researchers, and developers who download videos programmatically could inadvertently execute attacker commands on their systems. The risk is elevated in environments where shortcut files are shared or opened without scrutiny, and where the downloader runs with elevated privileges. Remediation is straightforward—updating to the patched version—but detection of past exploitation may require auditing shortcut files generated from untrusted sources.

Affected systems

yt-dlp and youtube-dl versions prior to 2026.7.4 are affected. Both Windows and Linux users are at risk, with slightly different attack vectors depending on the operating system's shortcut format. The vulnerability does not require network access from the attacker's infrastructure; malicious metadata can be embedded in any video URL or hosted on any web server. Organizations running these tools on systems where users execute downloaded shortcut files, or systems running batch download jobs, should prioritize patching.

Exploitability

Exploitation requires two conditions: (1) a user must download a video containing malicious metadata from an attacker-controlled or compromised source, and (2) the user must open the generated shortcut file. The attack is not remotely triggerable through the tool's normal operation; it depends on social engineering or compromised legitimate video sources. The CVSS 3.1 score of 7.5 (HIGH) reflects high impact (confidentiality, integrity, and availability) but acknowledges the requirement for user interaction and moderate attack complexity. No public exploit code is known to be active, and the vulnerability was not added to CISA's Known Exploited Vulnerabilities catalog as of the latest update.

Remediation

Update yt-dlp to version 2026.7.4 or later, or youtube-dl to the equivalent patched release. The patch validates and escapes metadata before writing shortcut files, preventing injection of malicious URIs or desktop entry keys. Users should also audit any shortcut files generated from downloads prior to patching, particularly those from untrusted or unusual sources. Disabling shortcut-generation options (--write-link, --write-url-link, --write-desktop-link) in high-risk environments where downloaded video sources cannot be fully trusted is a valid compensating control.

Patch guidance

Apply yt-dlp version 2026.7.4 or later as soon as feasible; this is a high-severity vulnerability with a straightforward patch and no known backward-compatibility issues. For youtube-dl, check the project's official repository for the corresponding patched version number. If you maintain automated download workflows, test the patched version in a non-production environment first to confirm compatibility with your use case. If shortcut file generation is not required for your workflow, consider disabling those options to reduce surface area.

Detection guidance

Search file systems for .url (Windows) and .desktop (Linux) files generated by yt-dlp or youtube-dl in the 90 days prior to your patching date. Look for unusual entries such as file:// URIs in .url files or suspicious Exec= lines in .desktop files. Monitor process execution following the opening of any auto-generated shortcut files from video downloads. Examine web server logs and video metadata from sources your organization downloads from to identify signs of tampering. If you log command-line invocations of yt-dlp or youtube-dl, review historical logs for use of the --write-link, --write-url-link, and --write-desktop-link flags in conjunction with unusual or external video sources.

Why prioritize this

This vulnerability merits HIGH priority due to its direct path to code execution, the wide user base of yt-dlp and youtube-dl, and the simplicity of the patch. While exploitation requires user interaction, the interaction is a normal part of the tool's intended workflow. Organizations relying on these tools for content curation, archival, or security research should patch immediately. The fact that it is not yet on CISA's KEV list should not delay patching, as that list reflects only confirmed active exploitation, not vulnerability severity.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) correctly weights the vulnerability: attack vector is Network (attacker can inject malicious metadata into a video URL), attack complexity is High (requires user interaction and specific tool options enabled), user interaction is Required (user must open the shortcut), and scope is Unchanged. The impact is High across all three dimensions—confidentiality (data exfiltration), integrity (code modification), and availability (system disruption or denial)—because code execution is achievable. The score balances the severity of the impact against the practical barriers to exploitation (metadata injection + user action).

Frequently asked questions