Executive brief
yt-dlp is a popular command-line tool used to download videos from various websites. A vulnerability exists where a maliciously crafted website can provide fake video information that causes yt-dlp to create dangerous shortcut files on the user's computer. If a user opens these generated shortcut files, an attacker could remotely execute commands or run malicious software on the user's system.
Technical details
A command injection vulnerability exists in yt-dlp when using the --write-link, --write-url-link, or --write-desktop-link options. The issue stems from improper sanitization of metadata (specifically webpage_url and filename) before writing it to .url (Windows) or .desktop (Linux) shortcut files. On Windows, an attacker can inject a file:// URI pointing to a remote executable. On Linux, if --no-windows-filenames is used, an attacker can use newline characters to inject 'Type=Application' and 'Exec' keys into the .desktop file. Exploitation requires the user to download content from a malicious site and subsequently execute the generated shortcut file. The vulnerability is fixed in version 2026.07.04.
Affected products
- yt-dlp yt-dlp < 2026.07.04
Timeline
- 2026-07-04: patched: Fixed in version 2026.07.04
- 2026-07-08: advisory: NVD publication date
- 2026-07-24: disclosed: GitHub Advisory published