CVE catalog

CVE-2026-55404

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using

[CVE catalog]

Severity: High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: Jul 6, 2026, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.64% · Oct 25, 2026

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	yt-dlp	sid	`2026.10.21-1`	fixed
Debian	yt-dlp	forky	`2026.10.21-1`	fixed
Debian	yt-dlp	trixie	`2025.04.30-1`	vulnerable
Debian	yt-dlp	bookworm	`2023.03.04-1`	vulnerable
Cpe	yt-dlp	Not reported	Not reported	vulnerable
Pip	yt-dlp	Not reported	`2026.7.4`	fixed
PyPI	yt-dlp	Not reported	`2026.7.4`	fixed
Opensuse	yt-dlp	tumbleweed	`2026.07.04-1.1`	fixed
Opensuse	yt-dlp	leap 16.0	`2026.08.19-bp160.1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	yt-dlp	source	sid	`2026.07.04-1`	not yet assigned	Not reported	Not reported
Debian	yt-dlp	source	forky	`2026.07.04-1`	not yet assigned	Not reported	Not reported
Debian	yt-dlp	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	yt-dlp	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
Pip	yt-dlp	pip	Not reported	`2026.7.4`	Not reported	Not reported	Not reported
PyPI	yt-dlp	PyPI	Not reported	`2026.7.4`	Not reported	PYSEC-2026-3622	Not reported
Opensuse	yt-dlp	rpm	tumbleweed	`2026.07.04-1.1`	Not reported	OPENSUSE-SU-2026:11196-1	Not reported
Opensuse	yt-dlp	rpm	leap 16.0	`2026.08.19-bp160.1.1`	Not reported	OPENSUSE-SU-2026:22142-1	Not reported

Notes

[trixie] yt-dlp: Minor issue [bookworm] yt-dlp: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[yt-dlp]Affected
Details (4)
- 2023.03.04-1 · all · bookworm
  Affected
  nvd · yt-dlp · debian · bookworm; nvd · yt-dlp · debian · 12
- 2023.03.04-1 · all · bookworm
  Affected
  nvd · yt-dlp · debian · bookworm; nvd · yt-dlp · debian · 12
- 2025.04.30-1~bpo12+1 · all · bookworm-backports
  Affected
  nvd · yt-dlp · debian · bookworm; nvd · yt-dlp · debian · 12
- 2025.04.30-1~bpo12+1 · all · bookworm-backports
  Affected
  nvd · yt-dlp · debian · bookworm; nvd · yt-dlp · debian · 12

[Debian 13 (Trixie)]

[yt-dlp]Affected
Details (4)
- 2025.04.30-1 · all · trixie
  Affected
  nvd · yt-dlp · debian · 13
- 2025.04.30-1 · all · trixie
  Affected
  nvd · yt-dlp · debian · 13
- 2026.08.19-1~bpo13+1 · all · trixie-backports
  Affected
  nvd · yt-dlp · debian · 13
- 2026.08.19-1~bpo13+1 · all · trixie-backports
  Affected
  nvd · yt-dlp · debian · 13

[openSUSE Tumbleweed]

[python313-yt-dlp]Unknown
Source package: [yt-dlp]
Details (1)
- 2026.08.19-1.1 · noarch · tumbleweed
  Unknown · Fixed: 2026.07.04-1.1
  Version impact unknown
  nvd · yt-dlp · opensuse · tumbleweed
[yt-dlp-youtube-dl]Unknown
Source package: [yt-dlp]
Details (1)
- 2026.08.19-1.1 · noarch · tumbleweed
  Unknown · Fixed: 2026.07.04-1.1
  Version impact unknown
  nvd · yt-dlp · opensuse · tumbleweed
[yt-dlp]Fixed
Source package: [yt-dlp]
Details (1)
- 2026.08.19-1.1 · noarch · tumbleweed
  Fixed · Fixed: 2026.07.04-1.1
  nvd · yt-dlp · opensuse · tumbleweed

Observed: Oct 25, 2026, 6:43:54 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]