CVE-2026-55404: yt-dlp Command Injection via Improper Shortcut Output Sanitization
Summary
CVE-2026-55404: yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output. Affects yt-dlp versions < 2026.7.4. Fixed in 2026.7.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
yt-dlp is a popular command-line program for downloading videos from various platforms. It is a fork of youtube-dl and offers additional features and improvements. The tool allows users to download media content and create shortcut files for easy access to the downloaded content. However, a recent vulnerability has been identified that exposes users to potential command injection attacks through improperly sanitized output when using specific options.
Vulnerability Detail
The vulnerability arises when users utilize the yt-dlp options --write-link, --write-url-link, or --write-desktop-link. These options can generate shortcut files that may contain malicious metadata payloads crafted by an attacker. If a user opens these files, it could lead to arbitrary command execution on their system. The vulnerability is particularly concerning for Windows users, where a crafted file URI could execute remote executables, and for Linux users, where unsanitized filename values could allow shell command injection.
How To Fix
Latest published version: 2026.10.21.233146.dev0 as of 22 Oct 2026
pip install --upgrade "yt-dlp==2026.10.21.233146.dev0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.7.4
This is the first release that contains the fix.
pip install --upgrade "yt-dlp==2026.7.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not possible, users should avoid using the --write-link, --write-url-link, or --write-desktop-link options until the package is updated.
Conclusion
The yt-dlp vulnerability CVE-2026-55404 poses a significant risk of command injection through improperly sanitized shortcut outputs. Users are strongly advised to upgrade to the patched version to mitigate this risk. For those unable to upgrade immediately, avoiding the use of specific options is recommended.
See every vulnerability recorded for yt-dlp →
FAQ
The vulnerability allows for command injection through improperly sanitized shortcut files created by yt-dlp.
Any version prior to 2026.07.04 is vulnerable. You can check your version by running 'yt-dlp --version'.
Both Windows and Linux platforms are affected, with different exploitation methods for each.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software without requiring access to the code.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for yt-dlp.
