Command Injection via Malicious .url/.desktop Files in yt-dlp

Impact Analysis

This vulnerability can lead to remote command execution if a user opens a maliciously crafted shortcut file generated by yt-dlp or youtube-dl using the affected options. An attacker can exploit this to run arbitrary commands on the victim's system.

The impact includes potential compromise of system confidentiality, integrity, and availability, as attackers could execute harmful commands remotely.

Because the attack requires user interaction (opening the malicious shortcut), the risk depends on user behavior, but the CVSS score of 7.5 indicates a high severity.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not explicitly address how CVE-2026-55404 affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the use of the --write-link, --write-url-link, or --write-desktop-link options in yt-dlp or youtube-dl to generate shortcut files containing untrusted metadata that can lead to command injection.

To detect if your system is vulnerable, you can check the version of yt-dlp or youtube-dl installed and whether these options have been used to generate shortcut files.

• Run `yt-dlp --version` or `youtube-dl --version` to verify if the version is prior to 2026.7.4.
• Search for any .url or .desktop files created by yt-dlp or youtube-dl that might contain suspicious or unexpected file:// URIs or newline characters in desktop entry keys.
• On Linux, you can use commands like `grep -rP '\n' /path/to/shortcuts` to find newline characters in .desktop files that could indicate injection.
• On Windows, inspect .url files for file:// URIs that are not expected or that point to remote executables.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-55404 is a command injection vulnerability in the yt-dlp and youtube-dl tools prior to version 2026.7.4. The vulnerability arises when using the --write-link, --write-url-link, or --write-desktop-link options, which create shortcut files (.url or .desktop) containing metadata such as webpage URLs or filenames. These metadata values were not properly validated or escaped, allowing an attacker to inject malicious content.

On Windows, this could allow malicious file:// URI injection in .url files, potentially executing remote executables when the shortcut is opened. On Linux, specially crafted filenames with newline characters could manipulate .desktop files to inject shell commands, leading to command execution.

The issue was fixed in version 2026.7.4 by validating URL schemes and properly escaping filenames to prevent injection attacks.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade yt-dlp or youtube-dl to version 2026.7.4 or later, where the vulnerability is fixed by validating and escaping values used in shortcut file generation.

Until you can upgrade, avoid using the --write-link, --write-url-link, and --write-desktop-link options to prevent generating potentially malicious shortcut files.

Additionally, review and remove any shortcut files (.url or .desktop) created by previous versions that might contain malicious payloads.

Useful 0 Not Useful 0