Read the docs
TI-2026-39974 Aliases CVE-2026-55404GHSA-6v4j-43gg-vj32

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

Priority MEDIUM 41CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0064 50th percentileScored 2026-11-07
Fix Fixed yt-dlp (yt-dlp): 2026.7.4yt-dlp (PyPI): 2026.7.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
yt-dlpyt-dlpbefore 2026.7.42026.7.4Patch availableCNA
—yt-dlp (PyPI)before 2026.7.42026.7.4Patch availableGHSA-6v4j-43gg-vj32
  • yt-dlp Vendoryt-dlp Affected before 2026.7.4 Fixed in 2026.7.4 Patch available CNA
  • yt-dlp (PyPI) Vendor— Affected before 2026.7.4 Fixed in 2026.7.4 Patch available GHSA-6v4j-43gg-vj32

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:yt-dlp_project:yt-dlp:*:*:*:*:*:*:*:*before 2026.07.04Vulnerableyt-dlp
  • cpe:2.3:a:yt-dlp_project:yt-dlp:*:*:*:*:*:*:*:* Versions before 2026.07.04 Vulnerable ·yt-dlp

Remediation

  • Fix · CNA yt-dlp (yt-dlp) Fixed in 2026.7.4
  • Fix · GHSA-6v4j-43gg-vj32 yt-dlp (PyPI) Fixed in 2026.7.4 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55404
  2. 2026-10-03 Alias added: GHSA-6v4j-43gg-vj32
  3. 2026-10-23 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 2

Other 4

  • TI-2024-03325 Command injection vulnerability in programing languages on Microsoft Windows operating system. CVSS 3.1CRITICAL 9.8
  • TI-2026-36849 yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519) CVSS 3.1CRITICAL 9.6
  • TI-2025-33915 yt-dlp allows `--exec` command injection when using placeholder on Windows CVSS 3.1HIGH 8.1
  • TI-2024-14996 yt-dlp `--exec` command injection when using `%q` in yt-dlp on Windows CVSS 3.1CRITICAL 9.8
  • TI-2026-21287 yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option CVSS 3.1HIGH 8.8
  • TI-2026-37295 yt-dlp: Arbitrary code execution via manifest downloads with aria2c CVSS 3.1CRITICAL 9.6
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences