yt-dlp Shortcut Command Injection Vulnerability

A significant vulnerability, CVE-2026-55404, has been identified in yt-dlp versions preceding 2026.7.4, enabling remote code execution through improper sanitization of metadata when generating shortcut files. Attackers can craft malicious webpage_url or filename values in the metadata of content downloaded via yt-dlp. If a user downloads this content using the --write-link, --write-url-link, or --write-desktop-link options, yt-dlp creates a malicious shortcut file. On Windows, this can be a .url file containing a file:// URI pointing to a remote executable. On Linux, particularly when --no-windows-filenames is also used, a .desktop file can be crafted with injected shell commands. If a user subsequently clicks these malicious shortcut files, the remote executable or shell command will be executed on their system, leading to arbitrary code execution. This vulnerability poses a direct threat to user systems by turning seemingly harmless shortcut files into vectors for payload delivery and execution.

Attack Chain

1. A remote attacker crafts a malicious metadata payload (e.g., webpage_url or filename) for content hosted on a website they control.
2. A user attempts to download this content using yt-dlp with the --write-link, --write-url-link, or --write-desktop-link options. For Linux .desktop exploitation, the user must also use the --no-windows-filenames option.
3. yt-dlp processes the malicious metadata and, due to improper sanitization, generates a malicious shortcut file (either a Windows .url or a Linux .desktop file) on the user's system.
4. In the Windows scenario, the generated .url file's content is manipulated to include a file:// URI pointing to a remote malicious executable (e.g., file://example.org/pwned.exe).
5. In the Linux scenario, the generated .desktop file's content is manipulated to set Type=Application and include an Exec line containing an arbitrary shell command (e.g., sh -c "touch /tmp/pwned").
6. The unsuspecting user subsequently double-clicks the malicious shortcut file.
7. If on Windows, the operating system's shell processes the .url file and executes the remote executable referenced by the file:// URI.
8. If on Linux, the desktop environment processes the .desktop file and executes the embedded shell command, resulting in arbitrary code execution on the user's system.

Impact

Successful exploitation of CVE-2026-55404 leads to arbitrary code execution on the affected user's system. This allows attackers to run any command, install malware, steal data, or further compromise the system with the privileges of the logged-in user. The impact is significant as it can lead to full system compromise without any overt signs of malicious activity beyond the user clicking a shortcut. All users of vulnerable yt-dlp versions who download content from untrusted sources with the specified options are at risk.

Recommendation

• Upgrade yt-dlp to version 2026.07.04 or newer immediately to mitigate CVE-2026-55404.
• If immediate upgrade is not possible, advise users to avoid using the --write-link, --write-url-link, or --write-desktop-link options with yt-dlp, especially when downloading from untrusted sources.
• Deploy the Sigma rule "Detects CVE-2026-55404 Exploitation - Linux Desktop Shortcut Command Execution" to your SIEM and tune for your environment to identify suspicious shell command execution.
• Enable process_creation logging for Linux endpoints to capture command-line arguments and parent process information necessary for the rule.