CVE-2026-55404: yt-dlp/youtube-dl RCE Vulnerability

CVE-2026-55404 Overview

CVE-2026-55404 affects yt-dlp and youtube-dl, widely used command-line audio and video downloaders. The vulnerability resides in the --write-link, --write-url-link, and --write-desktop-link options. These options generate .url or .desktop shortcut files using webpage_url and filename metadata from remote sources. Prior to version 2026.7.4, the code did not sufficiently validate or escape this attacker-controlled input. Attackers can inject malicious file:// URIs on Windows or newline-based desktop entry keys on Linux. When a user opens the generated shortcut, arbitrary commands execute in the victim's context. The issue is classified as [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact
Successful exploitation allows arbitrary command execution when a user opens a shortcut file generated by yt-dlp from attacker-controlled metadata.

Affected Products

yt-dlp versions prior to 2026.7.4
youtube-dl (shared codebase, same options affected)
Windows and Linux hosts where the generated .url or .desktop files are opened

Discovery Timeline

2026-07-08 - CVE-2026-55404 published to NVD
2026-07-08 - Last updated in NVD database
2026.7.4 - Fixed release published on GitHub

Technical Details for CVE-2026-55404

Vulnerability Analysis

The vulnerability is a shortcut file injection flaw in the link-writing logic of yt-dlp. The three affected options build shortcut files using metadata extracted from the target webpage. Because webpage_url and filename fields are not escaped, they can carry syntax that alters the resulting file structure.

On Windows, .url files use an INI-style format where the URL= value is executed by the shell handler. Injecting a file:// URI referencing an attacker-controlled UNC path or local binary redirects execution when the shortcut is opened.

On Linux, .desktop entries follow the Freedesktop specification. Newline characters in unescaped metadata allow injection of additional keys such as Exec=, which the desktop environment invokes when the entry is activated.

Root Cause

The root cause is missing output encoding for values written into structured shortcut files. The patch introduces _desktop_entry_localestring() to escape whitespace, newline, tab, carriage return, and backslash characters per the Freedesktop specification. The iri_to_uri() helper now accepts an allowed_schemes argument restricted by default to http and https, blocking file:// and other dangerous schemes.

Attack Vector

An attacker publishes or controls a media resource whose page metadata contains crafted webpage_url or filename values. A victim runs yt-dlp with --write-link, --write-url-link, or --write-desktop-link against the resource. The generated shortcut carries the injected payload. When the victim later double-clicks the shortcut, the operating system's shortcut handler executes the attacker-supplied command or dereferences the malicious file:// URI. User interaction is required.

python

# Security patch in yt_dlp/utils/_utils.py
# Source: https://github.com/yt-dlp/yt-dlp/commit/b6590aaa1e3808155d69c9a79a797ae484163789

# Ref: https://specifications.freedesktop.org/desktop-entry/latest/value-types.html
_DESKTOP_ENTRY_TRANS = str.maketrans({
    ' ': R'\s',
    '\n': R'\n',
    '\t': R'\t',
    '\r': R'\r',
    '\\': R'\\',
})


def _desktop_entry_localestring(s):
    return s.translate(_DESKTOP_ENTRY_TRANS)


def iri_to_uri(iri, *, allowed_schemes=('http', 'https')):
    """
    Converts an IRI (Internationalized Resource Identifier, allowing Unicode characters)
    to a URI (Uniform Resource Identifier, ASCII-only).
    """

The patch escapes control characters written into .desktop files and restricts URI schemes permitted in .url file output.

Detection Methods for CVE-2026-55404

Indicators of Compromise

.url files containing URL=file:// entries or UNC paths in directories used by yt-dlp output
.desktop files with Exec= keys that were not written by the user or a package manager
Shortcut files whose filename contains newline, backslash escapes, or unusual whitespace
Process trees where yt-dlp execution is followed by a shell or interpreter launched from a shortcut

Detection Strategies

Inventory yt-dlp installations and flag versions earlier than 2026.7.4
Scan directories used with --write-link, --write-url-link, and --write-desktop-link for shortcut files created after downloads
Parse .desktop files for multiple Exec= keys or Exec= values referencing shells, bash -c, cmd.exe, or powershell
Alert on .url files with schemes other than http or https in the URL= field

Monitoring Recommendations

Log command-line invocations of yt-dlp and youtube-dl, capturing option flags
Monitor child processes spawned from explorer.exe or desktop environments launching shortcuts placed in user download directories
Correlate shortcut-file creation events with subsequent shell or scripting engine execution

How to Mitigate CVE-2026-55404

Immediate Actions Required

Upgrade yt-dlp to version 2026.7.4 or later on all systems and CI pipelines
Audit existing shortcut files created by prior yt-dlp runs and remove any with unexpected schemes or Exec= keys
Avoid opening .url or .desktop files generated from untrusted sources until validated

Patch Information

The fix is included in the GitHub Release 2026.07.04. The corresponding source change is documented in the GitHub Commit b6590aa and GitHub Security Advisory GHSA-6v4j-43gg-vj32.

Workarounds

Do not use --write-link, --write-url-link, or --write-desktop-link against untrusted URLs until upgraded
Restrict yt-dlp output directories to locations that are not indexed by the desktop shell
Configure endpoint policy to block execution of shortcut files from download directories

bash

# Upgrade yt-dlp using pip
python -m pip install --upgrade "yt-dlp>=2026.7.4"

# Verify installed version
yt-dlp --version

# If unable to upgrade immediately, avoid the vulnerable options
# Do NOT run:
#   yt-dlp --write-link <url>
#   yt-dlp --write-url-link <url>
#   yt-dlp --write-desktop-link <url>