CVE-2026-55404: yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
If the --write-link, --write-url-link or --write-desktop-link options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the .url and .desktop shortcut files written by yt-dlp. This allows for malicious shell commands or malicious remote executables to run on the user’s system if the user executes the generated .url or .desktop files.
References
- github.com/advisories/GHSA-6v4j-43gg-vj32
- github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2026.07.04.221833
- github.com/yt-dlp/yt-dlp/commit/6fc85f617a5850307fd5b258477070e6ee177796
- github.com/yt-dlp/yt-dlp/commit/b6590aaa1e3808155d69c9a79a797ae484163789
- github.com/yt-dlp/yt-dlp/releases/tag/2026.07.04
- github.com/yt-dlp/yt-dlp/security/advisories/GHSA-6v4j-43gg-vj32
- nvd.nist.gov/vuln/detail/CVE-2026-55404
Code Behaviors & Features
Detect and mitigate CVE-2026-55404 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →