CVE-2026-55404
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.
- Record
CVE-2026-55404- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
EUVDEUVD-2026-42368
yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.
- Record
EUVD-2026-42368- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6v4j-43gg-vj32
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
Summary
If the --write-link, --write-url-link or --write-desktop-link options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the .url and .desktop shortcut files written by yt-dlp. This allows for malicious shell commands or malicious remote executables to run on the user's system if the user executes the generated .url or .desktop files.
Details
The expected result of yt-dlp's --write-link, --write-url-link and --write-desktop-link options is to write a shortcut file that points to the webpage URL for the content downloaded by yt-dlp. The --write-url-link option writes a .url shortcut file for Windows, the --write-desktop-link option writes a .desktop shortcut file for Linux, and the --write-link option may write a .url file or a .desktop file depending on the user's platform.
There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files.
Scenario 1: file:// URI injection in Windows .url shortcut
If a yt-dlp user passes the --write-link or --write-url-link option to generate a Windows .url file, the URL written to the shortcut file is sourced from the downloaded media's metadata--specifically, its webpage_url value. This value is commonly a normalized version of the input URL passed to yt-dlp by the user, but in some cases it may be extracted from untrusted web input. Validation of this webpage_url value is performed if it is fed back to yt-dlp as an input URL (e.g. via the --load-info-json option), but no validation is performed before it is output to a .url shortcut file.
This lack of validation is exploitable by a remote attacker who crafts a malicious metadata payload such that the resulting webpage_url value is a file:// URI. A malicious file URI could point to a remote executable, e.g. file://example.org/pwned.exe. If a Windows user double-clicks a .url file that points to this webpage_url, Windows will execute the malicious remote executable on the user's system.
Scenario 2: Shell command injection in Linux .desktop shortcut
The Linux .desktop file format is a more versatile than the Windows .url file format. It is defined by the freedesktop.org "desktop entry" file specification, and supports multiple types of shortcuts: a Link type for URLs, a Directory type for filesystem folders, and an Application type for programs or shell commands. yt-dlp outputs a desktop entry file of the Link type, using the template below:
[Desktop Entry]
Encoding=UTF-8
Name=%(filename)s
Type=Link
URL=%(url)s
Icon=text-html
The keys under the [Desktop Entry] group are separated by newlines, and the type of desktop entry is set by the value paired to the Type key.
If a yt-dlp user passes the --write-link or --write-desktop-link option to generate a desktop entry file, in addition to the webpage_url value there is a filename value that is written to the shortcut file. By default, yt-dlp will sanitize the filename value: this sanitization includes replacing newlines with spaces and removing other control characters. However, the --no-windows-filenames option was modified in yt-dlp version 2024.12.23 to disable this default filename sanitization when used.
If the user passes --write-link or --write-desktop-link together with --no-windows-filenames to yt-dlp, an unsanitized filename value can be written to the resulting desktop entry file. A remote attacker can exploit this lack of sanitization by crafting a malicious metadata payload such that the resulting filename value contains newline characters, which can be used to inject arbitrary groups, keys and values into the desktop entry…
- Record
GHSA-6v4j-43gg-vj32- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
NVD
yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.
- Record
CVE-2026-55404- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
OSV
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.
- Record
CVE-2026-55404- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-55404
yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.
- Record
DEBIAN-CVE-2026-55404- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-6v4j-43gg-vj32
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
Summary
If the --write-link, --write-url-link or --write-desktop-link options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the .url and .desktop shortcut files written by yt-dlp. This allows for malicious shell commands or malicious remote executables to run on the user's system if the user executes the generated .url or .desktop files.
Details
The expected result of yt-dlp's --write-link, --write-url-link and --write-desktop-link options is to write a shortcut file that points to the webpage URL for the content downloaded by yt-dlp. The --write-url-link option writes a .url shortcut file for Windows, the --write-desktop-link option writes a .desktop shortcut file for Linux, and the --write-link option may write a .url file or a .desktop file depending on the user's platform.
There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files.
Scenario 1: file:// URI injection in Windows .url shortcut
If a yt-dlp user passes the --write-link or --write-url-link option to generate a Windows .url file, the URL written to the shortcut file is sourced from the downloaded media's metadata--specifically, its webpage_url value. This value is commonly a normalized version of the input URL passed to yt-dlp by the user, but in some cases it may be extracted from untrusted web input. Validation of this webpage_url value is performed if it is fed back to yt-dlp as an input URL (e.g. via the --load-info-json option), but no validation is performed before it is output to a .url shortcut file.
This lack of validation is exploitable by a remote attacker who crafts a malicious metadata payload such that the resulting webpage_url value is a file:// URI. A malicious file URI could point to a remote executable, e.g. file://example.org/pwned.exe. If a Windows user double-clicks a .url file that points to this webpage_url, Windows will execute the malicious remote executable on the user's system.
Scenario 2: Shell command injection in Linux .desktop shortcut
The Linux .desktop file format is a more versatile than the Windows .url file format. It is defined by the freedesktop.org "desktop entry" file specification, and supports multiple types of shortcuts: a Link type for URLs, a Directory type for filesystem folders, and an Application type for programs or shell commands. yt-dlp outputs a desktop entry file of the Link type, using the template below:
[Desktop Entry]
Encoding=UTF-8
Name=%(filename)s
Type=Link
URL=%(url)s
Icon=text-html
The keys under the [Desktop Entry] group are separated by newlines, and the type of desktop entry is set by the value paired to the Type key.
If a yt-dlp user passes the --write-link or --write-desktop-link option to generate a desktop entry file, in addition to the webpage_url value there is a filename value that is written to the shortcut file. By default, yt-dlp will sanitize the filename value: this sanitization includes replacing newlines with spaces and removing other control characters. However, the --no-windows-filenames option was modified in yt-dlp version 2024.12.23 to disable this default filename sanitization when used.
If the user passes --write-link or --write-desktop-link together with --no-windows-filenames to yt-dlp, an unsanitized filename value can be written to the resulting desktop entry file. A remote attacker can exploit this lack of sanitization by crafting a malicious metadata payload such that the resulting filename value contains newline characters, which can be used to inject arbitrary groups, keys and values into the desktop entry…
- Record
GHSA-6v4j-43gg-vj32- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
OSVPYSEC-2026-3622
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
Summary
If the --write-link, --write-url-link or --write-desktop-link options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the .url and .desktop shortcut files written by yt-dlp. This allows for malicious shell commands or malicious remote executables to run on the user's system if the user executes the generated .url or .desktop files.
Details
The expected result of yt-dlp's --write-link, --write-url-link and --write-desktop-link options is to write a shortcut file that points to the webpage URL for the content downloaded by yt-dlp. The --write-url-link option writes a .url shortcut file for Windows, the --write-desktop-link option writes a .desktop shortcut file for Linux, and the --write-link option may write a .url file or a .desktop file depending on the user's platform.
There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files.
Scenario 1: file:// URI injection in Windows .url shortcut
If a yt-dlp user passes the --write-link or --write-url-link option to generate a Windows .url file, the URL written to the shortcut file is sourced from the downloaded media's metadata--specifically, its webpage_url value. This value is commonly a normalized version of the input URL passed to yt-dlp by the user, but in some cases it may be extracted from untrusted web input. Validation of this webpage_url value is performed if it is fed back to yt-dlp as an input URL (e.g. via the --load-info-json option), but no validation is performed before it is output to a .url shortcut file.
This lack of validation is exploitable by a remote attacker who crafts a malicious metadata payload such that the resulting webpage_url value is a file:// URI. A malicious file URI could point to a remote executable, e.g. file://example.org/pwned.exe. If a Windows user double-clicks a .url file that points to this webpage_url, Windows will execute the malicious remote executable on the user's system.
Scenario 2: Shell command injection in Linux .desktop shortcut
The Linux .desktop file format is a more versatile than the Windows .url file format. It is defined by the freedesktop.org "desktop entry" file specification, and supports multiple types of shortcuts: a Link type for URLs, a Directory type for filesystem folders, and an Application type for programs or shell commands. yt-dlp outputs a desktop entry file of the Link type, using the template below:
[Desktop Entry]
Encoding=UTF-8
Name=%(filename)s
Type=Link
URL=%(url)s
Icon=text-html
The keys under the [Desktop Entry] group are separated by newlines, and the type of desktop entry is set by the value paired to the Type key.
If a yt-dlp user passes the --write-link or --write-desktop-link option to generate a desktop entry file, in addition to the webpage_url value there is a filename value that is written to the shortcut file. By default, yt-dlp will sanitize the filename value: this sanitization includes replacing newlines with spaces and removing other control characters. However, the --no-windows-filenames option was modified in yt-dlp version 2024.12.23 to disable this default filename sanitization when used.
If the user passes --write-link or --write-desktop-link together with --no-windows-filenames to yt-dlp, an unsanitized filename value can be written to the resulting desktop entry file. A remote attacker can exploit this lack of sanitization by crafting a malicious metadata payload such that the resulting filename value contains newline characters, which can be used to inject arbitrary groups, keys and values into the desktop entry…
- Record
PYSEC-2026-3622- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-55404
yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.
- Record
UBUNTU-CVE-2026-55404- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11196-1 No score
python313-yt-dlp-2026.07.04-1.1 on GA media
These are all security issues fixed in the python313-yt-dlp-2026.07.04-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11196-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:22142-1 No score
Security update for yt-dlp
This update for yt-dlp fixes the following issues:
Changes in yt-dlp:
Update to version 2026.08.19:
- utils: float_or_none: Catch OverflowError
- americastestkitchen: Fix season/series extraction
- apple: Rework extractors
- ard: Remove dead extractor
- bandcamp: Support browser impersonation
- bfmtv: Fix extractor
- instagram: Fix logged-in extraction
- showroom: Rework extractors
- tiktok: Fix extractor
- tiktok: Fix formats extraction
- tiktok: Support share URLs
- twitter: broadcast: Fix events handling
- vimeo: Remove ios and macos clients
- whyp: Fix extractor
- youtube: Add visionos player client
- youtube: Add web_embedded client fallbacks
- youtube: Extract channel_follower_count for collaborators
- youtube: Fix live adaptive fragments generation
- youtube: Remove android_vr from default clients
- youtube: tab: Always extract channel metadata
- hls: Fix crash on empty fragment lists in tests
Update to version 2026.07.04:
- The minimum recommended Python version has been raised to 3.11
- Security: [CVE-2026-55404 bsc#1286026] Downstream command injection via improper sanitization of --write-link output
- Shortcut file data is now properly validated and sanitized when the --write-link options are used
- Always include warnings in debug output
- Fix allow-unsafe-ext compat option
- Raise minimum recommended Python version to 3.11
- Validate and escape values in --write-link output
- cookies: Use ' instead of " for SQL string quoting
- utils: Deprecate make_dir in favor of make_parent_dirs
- utils: HTTPHeaderDict: Fix ior
- utils: parse_duration: Return int when appropriate
- utils: parse_resolution: Support fps suffixes
- utils: pkcs1pad: Fix invalid PKCS#1 v1.5 padding bytes
- utils: qualities: Avoid repeated index lookups
- utils: random_user_agent: Bump version range 143-149 => 144-150
- Always include id in request error output
- Fix request logging
- arte: Fix playlist support
- bandcamp: weekly: Fix extractor
- bilibili: Fix API extraction
- instagram: Detect when cookies are invalidated
- instagram: Rework extractor
- linkedin: Remove broken login support
- mgtv: Fix VIP stream extraction
- mxplayer: Fix extractors
- mxplayer: Rework extractors
- niconico: Fix error detection
- niconico: Support shorts
- omnyfm: Add extractors
- openrec: Rework extractors
- patreon: Support new URL format
- peertube: Support password-protected videos
- periscope: Improve metadata extraction
- reddit: Remove broken login support
- soundcloud: Extract uploader_url for playlists
- soundcloud: Extract comments
- soundcloud: Improve metadata extraction
- streaks: Fix extractor
- svt: Fix extractor
- telewebion: Fix extractor
- trovo: Remove dead extractors
- truth: Support share URLs
- tviplayer: Fix extractor
- unsupported: Update unsupported sites
- wrestleuniverse: vod: Fix extractor
- youtube: Fix extract_relative_time for abbreviated units
- youtube: Fix detection of forced preroll wait time
- youtube: Fix minor issues
- youtube: Support live adaptive formats
- tab: Fix flat extraction of collaborators
- tab: Fix flat playlist metadata extraction
- tab: Fix metadata extraction
- tab: Fix pagination
- zan: Add extractor
- zdf: Detect livestreams
- zoom: clips: Add extractor
- external: Fix resuming downloads with aria2c
- external: curl: Support development versions
- mhtml: Fix storyboard content-length calculation
- build: Update 17 dependencies
- build: Update 6 dependencies
- cleanup: Fix invalid info dict fields
- cleanup: Fix minor mistakes
- cleanup: Remove RTSP and MMS support
- cleanup: Replace dead example/test URL
- cleanup: Miscellaneous: 997fa14
- docs: Make "No AI / No LLM Policy" abundantly clear
- Record
openSUSE-SU-2026:22142-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
yt-dlpPyPI |
before 2026.7.4 | 2026.7.4 |
yt-dlpDebian:12 |
All versions, plus listed versions 2023.03.04-12023.06.21-12023.06.22-12023.06.22-1~bpo12+12023.07.06-1 Show 45 moreShow less2023.07.06-1~bpo12+12023.09.24-12023.09.24-22023.09.24-2~bpo12+12023.10.07-12023.10.07-1~bpo12+12023.10.13-12023.10.13-1~bpo11+12023.10.13-1~bpo12+12023.11.16-12023.11.16-1~bpo11+12023.11.16-1~bpo12+12023.12.30-12024.03.10-12024.03.10-1~bpo12+12024.04.09-12024.04.09-1~bpo12+12024.05.26-12024.05.26-1~bpo12+12024.05.27-12024.05.27-1~bpo12+12024.07.01-12024.07.02-12024.07.02-1~bpo12+12024.07.07-12024.07.09-12024.07.09-1~bpo12+12024.07.16-12024.07.16-1~bpo12+12024.07.25-12024.07.25-1~bpo12+12024.08.01-12024.08.01-1~bpo12+12024.08.06-12024.08.06-1~bpo12+12024.09.27-12024.09.27-1~bpo12+12024.10.07-12024.10.07-1~bpo12+12024.10.22-12024.10.22-1~bpo12+12024.11.04-12024.11.18-12024.11.18-1~bpo12+12024.12.03-1 |
None known |
yt-dlpDebian:13 |
All versions, plus listed versions 2025.04.30-12025.05.22-12025.06.09-12025.06.25-12025.06.30-1 Show 36 moreShow less2025.07.21-12025.08.11-12025.08.11-1~bpo13+12025.08.20-12025.08.22-12025.08.27-12025.08.27-1~bpo13+12025.09.05-12025.09.05-1~bpo13+12025.09.23-12025.09.26-12025.09.26-1~bpo13+12025.10.14-12025.10.14-1~bpo13+12025.10.22-12025.10.22-1~bpo13+12025.11.12-12025.11.12-1~bpo13+12025.12.08-12025.12.08-1~bpo13+12026.01.31-12026.01.31-1~bpo13+12026.02.21-12026.02.21-1~bpo13+12026.03.03-12026.03.03-1~bpo13+12026.03.13-12026.03.13-1~bpo13+12026.03.17-12026.03.17-1~bpo13+12026.06.09-12026.06.09-1~bpo13+12026.07.04-12026.07.04-1~bpo13+12026.08.19-12026.08.19-1~bpo13+1 |
None known |
yt-dlpDebian:14 |
before 2026.07.04-1, plus listed versions 2025.04.30-12025.05.22-12025.06.09-12025.06.25-12025.06.30-1 Show 33 moreShow less2025.07.21-12025.08.11-12025.08.11-1~bpo13+12025.08.20-12025.08.22-12025.08.27-12025.08.27-1~bpo13+12025.09.05-12025.09.05-1~bpo13+12025.09.23-12025.09.26-12025.09.26-1~bpo13+12025.10.14-12025.10.14-1~bpo13+12025.10.22-12025.10.22-1~bpo13+12025.11.12-12025.11.12-1~bpo13+12025.12.08-12025.12.08-1~bpo13+12026.01.31-12026.01.31-1~bpo13+12026.02.21-12026.02.21-1~bpo13+12026.03.03-12026.03.03-1~bpo13+12026.03.13-12026.03.13-1~bpo13+12026.03.17-12026.03.17-1~bpo13+12026.06.09-12026.06.09-1~bpo13+12026.07.04-1~bpo13+1 |
2026.07.04-1 |
yt-dlpPyPI |
before 2026.7.4, plus listed versions 2021.1.152021.1.15.post12021.1.162021.1.202021.1.24 Show 45 moreShow less2021.1.24.post12021.1.292021.10.102021.10.222021.10.92021.11.102021.11.10.12021.12.12021.12.252021.12.272021.2.152021.2.192021.2.242021.2.42021.2.92021.3.12021.3.152021.3.212021.3.242021.3.24.12021.3.32021.3.3.12021.3.3.22021.3.72021.4.112021.4.222021.4.32021.5.112021.5.202021.6.12021.6.232021.6.82021.6.92021.7.212021.7.242021.7.72021.8.102021.8.22021.9.12021.9.22021.9.252022.1.212022.10.42022.11.112022.2.3 |
2026.7.4 |
youtube-dlUbuntu:16.04:LTS |
All versions, plus listed versions 2015.06.04.1-12015.11.10-12015.11.27.1-12015.11.27.1-1.12016.02.09-0ubuntu12016.02.22-1 |
None known |
youtube-dlUbuntu:18.04:LTS |
All versions, plus listed versions 2017.09.24-0.12017.10.15.1-12017.11.06-12017.12.31-12018.01.27-12018.03.14-12018.03.14-1ubuntu18.04.1 |
None known |
youtube-dlUbuntu:20.04:LTS |
All versions, plus listed versions 2019.09.28-12020.01.24-0.12020.03.08-0ubuntu12020.03.24-0ubuntu12020.03.24-1 |
None known |
youtube-dlUbuntu:22.04:LTS |
All versions, plus listed versions 2021.06.06-12021.12.17-1 |
None known |
yt-dlpUbuntu:22.04:LTS |
All versions, plus listed versions 2021.12.01-12021.12.27-12022.01.21-12022.02.04-12022.03.08.1-12022.04.08-1 |
None known |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
yt-dlpUbuntu:24.04:LTS |
All versions, plus listed versions 2023.07.06-12023.10.13-1ubuntu12023.11.16-12023.12.30-1ubuntu12024.03.10-12024.04.09-1 |
None known |
yt-dlpUbuntu:25.10 |
All versions, plus listed versions 2025.03.27-12025.04.30-12025.05.22-12025.06.09-12025.06.25-1 Show 8 moreShow less2025.06.30-12025.07.21-12025.08.11-12025.08.20-12025.08.22-12025.08.27-12025.09.05-12025.09.23-1 |
None known |
yt-dlpUbuntu:26.10 |
All versions, plus listed versions 2026.03.17-12026.06.09-12026.07.04-12026.08.19-1 |
None known |
yt-dlpUbuntu:26.04:LTS |
All versions, plus listed versions 2025.09.23-12025.10.22-12025.11.12-12025.12.08-12026.01.31-12026.03.17-1 |
None known |
yt-dlpopenSUSE:Tumbleweed |
before 2026.07.04-1.1 | 2026.07.04-1.1 |
yt-dlpopenSUSE:Leap 16.0 |
before 2026.08.19-bp160.1.1 | 2026.08.19-bp160.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-55404 is a high vulnerability (CVSS 7.5) in Yt-dlp, published July 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.64%, the 50th percentile. Fixed in yt-dlp 2026.7.4.
References
github.com/yt-dlp/yt-dlp/security/advisories/GHSA-6v4j-43gg-vj32
nvd.nist.gov/vuln/detail/CVE-2026-55404
Show 9 moreShow less
security-tracker.debian.org/tracker/CVE-2026-55404
pypi.org/project/yt-dlp
ubuntu.com/security/CVE-2026-55404
cve.org/CVERecord?id=CVE-2026-55404
suse.com/security/cve/CVE-2026-55404
bugzilla.suse.com/1286026
Left out here: 633 versions and the rest of 3 source descriptions. The JSON record has them.