What is the CVSS score of CVE-2026-55404?

CVE-2026-55404 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Is there a public PoC exploit available for CVE-2026-55404?

Yes, a public proof-of-concept exploit is available for CVE-2026-55404. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2026-55404?

Within 24 hours, inventory all deployments of yt-dlp and youtube-dl in your environment, specifically identifying instances using the --write-link, --write-url-link, or --write-desktop-link options. Within 7 days, update both tools to version 2026.7.4 or later across all affected systems; for environments requiring extended testing, immediately disable the affected shortcut file generation options as an interim measure. Within 30 days, verify successful patching across the environment and consider implementing file integrity monitoring for .url and .desktop files to detect suspicious creation patterns.

yt-dlp CVE-2026-55404

Q: Which versions of yt-dlp are affected by CVE-2026-55404?

yt-dlp and youtube-dl contain a critical command injection vulnerability (CVE-2026-55404, CVSS 8.8) affecting users who download videos with shortcut file creation enabled.. A patch is available.

EUVD-2026-42368 HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-07-08 GitHub_M

GHSA-6v4j-43gg-vj32

Microsoft Code Injection Yt Dlp Suse

8.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Host malicious page with crafted URL/title metadata
Delivery

Victim downloads with --write-desktop-link/--write-url-link
Exploit

Poisoned shortcut written without escaping
Execution

Victim opens .url/.desktop shortcut
Impact

Injected file:// URI or Exec key runs commands

Vulnerability Assessment

Weakness	CWE CWE-74 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Input neutralization, injection prevention
Exploitation Conditions	Exploitation requires that the victim run yt-dlp/youtube-dl (before 2026.7.4) with one of the shortcut-writing options explicitly enabled - --write-link, --write-url-link, or --write-desktop-link - against a source whose webpage_url or filename metadata the attacker controls; these options are NOT enabled by default, which is the primary limiting factor. It further requires a second user action: the victim must actually open the generated .url/.desktop shortcut for the injected file:// URI (Windows) or Desktop Entry key (Linux) to execute (this is the UI:R in the CVSS vector). Platform matters - file:// injection targets Windows .url handling while newline key injection targets Linux .desktop parsing. No authentication is required (PR:N), but the double user-interaction dependency and non-default configuration substantially narrow real-world exploitability.
Impact	Signals are mixed and should temper the raw 8.8 CVSS. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a network-delivered, unauthenticated payload but critically requires user interaction (UI:R) twice over: the victim must both invoke a non-default shortcut-writing option and later open the crafted shortcut. CISA SSVC corroborates the lower urgency - Exploitation: none and Automatable: no - while agreeing the Technical Impact is total (code execution). EPSS is low-to-moderate at 0.55% (42nd percentile), and there is no KEV listing and no identified public exploit, so this is not an actively-exploited, wormable issue. It is nonetheless a legitimate code-execution risk for the specific population that runs yt-dlp with --write-link/--write-url-link/--write-desktop-link against untrusted sources. Net: real but conditional priority - patch on a normal cycle rather than emergency, prioritizing systems/automation that generate shortcut files from arbitrary URLs.
Exploit ScenarioDerived	An attacker publishes a video or webpage whose title/URL metadata embeds a file:// URI (Windows) or an extra newline-delimited Desktop Entry key with an Exec-style payload (Linux). A victim downloads it with yt-dlp using --write-url-link or --write-desktop-link, producing a poisoned shortcut in their download folder; when the victim double-clicks that shortcut, the injected command or file reference executes in their context. No public POC is identified, but the fix commit's tests demonstrate the exact injection primitives (file:// scheme and newline escaping).

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 13, 2026

Command injection in yt-dlp and youtube-dl before 2026.7.4 lets a malicious video/webpage host smuggle attacker-controlled data into shortcut files generated by the --write-link, --write-url-link, and --write-desktop-link options. Because webpage_url and filename metadata are written to .url/.desktop files without validation or escaping, an attacker can inject a file:// URI on Windows or a newline-based Desktop Entry key on Linux that runs commands when the victim later opens the generated shortcut. No public exploit identified at time of analysis; EPSS is modest at 0.55% and CISA SSVC records exploitation as none, but technical impact is rated total.

Earlier versions of this analysis (2)

v2 Jul 13, 2026 - 19:34 cvss changed CVSS 8.8

Code injection in yt-dlp and youtube-dl before 2026.7.4 lets a malicious video/webpage host plant executable shortcut files when a user runs the downloader with the --write-link, --write-url-link, or --write-desktop-link options. Attacker-controlled webpage_url or filename metadata is written into .url or .desktop files without escaping, enabling file:// URI injection on Windows or newline-based Desktop Entry key injection on Linux that runs commands when the victim opens the shortcut. No public exploit identified at time of analysis; EPSS is low (0.55%), and CISA SSVC records exploitation status as none.

v1 Jul 08, 2026 - 20:36 CVSS 7.5

Command injection via shortcut-file generation in yt-dlp and youtube-dl (before 2026.7.4) allows a malicious website operator to embed attacker-controlled webpage_url or filename metadata that is written unescaped into .url or .desktop files when a user runs --write-link, --write-url-link, or --write-desktop-link, executing commands if the victim later opens the generated shortcut. On Windows this manifests as file:// URI injection and on Linux as newline-based desktop-entry key injection. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix shipped in version 2026.7.4.

RemediationAI

Vendor-released patch: upgrade to yt-dlp 2026.7.4 or later (release https://github.com/yt-dlp/yt-dlp/releases/tag/2026.07.04; fix commit https://github.com/yt-dlp/yt-dlp/commit/b6590aaa1e3808155d69c9a79a797ae484163789), which validates the URL scheme (only http/https allowed) and escapes Desktop Entry localestrings. Until you can upgrade, the most direct compensating control is to stop passing --write-link, --write-url-link, and --write-desktop-link when downloading from untrusted or user-supplied URLs - the trade-off is losing automatic shortcut generation. Additionally, run yt-dlp against only trusted sources, and instruct users/operators not to open shortcut files produced from arbitrary downloads; on Linux, treat generated .desktop files as untrusted and inspect them (or strip execute permission) before use. Consult GHSA-6v4j-43gg-vj32 for advisory details.

Affected VersionsENISA

yt-dlp < 2026.7.4

Affected Packages

pypi yt-dlp fix: 2026.7.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

yt-dlp is a Python-based command-line audio/video downloader (a maintained fork of youtube-dl) with a CPE of cpe:2.3:a:yt-dlp:yt-dlp. The vulnerable feature is its 'internet shortcut' writers, which serialize extracted metadata into platform shortcut formats: Windows .url files (which support a URL= key that can point at a file:// path) and freedesktop .desktop entries (which contain executable keys and honor localestring escaping rules). The root cause maps to CWE-74 (improper neutralization of special elements / injection): the URL field was written without scheme validation and the filename/localestring field was written without escaping control characters. The commit (b6590aa) fixes this by adding iri_to_uri(..., allowed_schemes=('http','https')) to reject non-web schemes such as file://, and by introducing _desktop_entry_localestring(), which escapes spaces, tab, CR, LF, and backslash per the freedesktop Desktop Entry value-type spec so newline key injection is neutralized.

Know when Yt Dlp gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY HIGH

NVD 8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI 8.8 HIGH

Attacker-controlled remote metadata (AV:N, PR:N) but exploitation needs a non-default option plus the victim opening the shortcut (UI:R); opened shortcut yields full code execution (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 13, 2026 - 19:35 vuln.today

v3 - CVSS changed

Analysis Updated

Jul 13, 2026 - 19:34 vuln.today

v2 - CVSS changed

CVSS changed

Jul 13, 2026 - 19:07 NVD

7.5 (HIGH) 8.8 (HIGH)

Patch available

Jul 08, 2026 - 21:04 EUVD

CVE Published

Jul 08, 2026 - 19:36 cve.org

HIGH 7.5

DescriptionNVD

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

7 pypi packages depend on yt-dlp (7 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.7.4.

Executive ViewAI

Why It Matters

yt-dlp and youtube-dl contain a critical command injection vulnerability (CVE-2026-55404, CVSS 8.8) affecting users who download videos with shortcut file creation enabled. While no public exploit has been identified at time of analysis, compromised shortcut files execute arbitrary code at user privilege levels when opened, creating risk of system compromise, data theft, or lateral movement within affected environments.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.6%

Top 58% exploitable

Prevalence

High

extremely popular media downloader, though vulnerable shortcut options are non-default

Threat Intel

1 source

Exploit

POC

Public exploit code exists

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.6%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +44

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.