{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3ayt-dlp_projectyt-dlp/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:yt-dlp_project:yt-dlp:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-55404"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["yt-dlp (\u003c 2026.7.4)"],"_cs_severities":["high"],"_cs_tags":["command-injection","rce","client-side","vulnerability","code-execution"],"_cs_type":"advisory","_cs_vendors":["yt-dlp"],"content_html":"\u003cp\u003eA significant vulnerability, CVE-2026-55404, has been identified in yt-dlp versions preceding 2026.7.4, enabling remote code execution through improper sanitization of metadata when generating shortcut files. Attackers can craft malicious \u003ccode\u003ewebpage_url\u003c/code\u003e or \u003ccode\u003efilename\u003c/code\u003e values in the metadata of content downloaded via yt-dlp. If a user downloads this content using the \u003ccode\u003e--write-link\u003c/code\u003e, \u003ccode\u003e--write-url-link\u003c/code\u003e, or \u003ccode\u003e--write-desktop-link\u003c/code\u003e options, yt-dlp creates a malicious shortcut file. On Windows, this can be a \u003ccode\u003e.url\u003c/code\u003e file containing a \u003ccode\u003efile://\u003c/code\u003e URI pointing to a remote executable. On Linux, particularly when \u003ccode\u003e--no-windows-filenames\u003c/code\u003e is also used, a \u003ccode\u003e.desktop\u003c/code\u003e file can be crafted with injected shell commands. If a user subsequently clicks these malicious shortcut files, the remote executable or shell command will be executed on their system, leading to arbitrary code execution. This vulnerability poses a direct threat to user systems by turning seemingly harmless shortcut files into vectors for payload delivery and execution.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eA remote attacker crafts a malicious metadata payload (e.g., \u003ccode\u003ewebpage_url\u003c/code\u003e or \u003ccode\u003efilename\u003c/code\u003e) for content hosted on a website they control.\u003c/li\u003e\n\u003cli\u003eA user attempts to download this content using \u003ccode\u003eyt-dlp\u003c/code\u003e with the \u003ccode\u003e--write-link\u003c/code\u003e, \u003ccode\u003e--write-url-link\u003c/code\u003e, or \u003ccode\u003e--write-desktop-link\u003c/code\u003e options. For Linux \u003ccode\u003e.desktop\u003c/code\u003e exploitation, the user must also use the \u003ccode\u003e--no-windows-filenames\u003c/code\u003e option.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eyt-dlp\u003c/code\u003e processes the malicious metadata and, due to improper sanitization, generates a malicious shortcut file (either a Windows \u003ccode\u003e.url\u003c/code\u003e or a Linux \u003ccode\u003e.desktop\u003c/code\u003e file) on the user's system.\u003c/li\u003e\n\u003cli\u003eIn the Windows scenario, the generated \u003ccode\u003e.url\u003c/code\u003e file's content is manipulated to include a \u003ccode\u003efile://\u003c/code\u003e URI pointing to a remote malicious executable (e.g., \u003ccode\u003efile://example.org/pwned.exe\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eIn the Linux scenario, the generated \u003ccode\u003e.desktop\u003c/code\u003e file's content is manipulated to set \u003ccode\u003eType=Application\u003c/code\u003e and include an \u003ccode\u003eExec\u003c/code\u003e line containing an arbitrary shell command (e.g., \u003ccode\u003esh -c \u0026quot;touch /tmp/pwned\u0026quot;\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe unsuspecting user subsequently double-clicks the malicious shortcut file.\u003c/li\u003e\n\u003cli\u003eIf on Windows, the operating system's shell processes the \u003ccode\u003e.url\u003c/code\u003e file and executes the remote executable referenced by the \u003ccode\u003efile://\u003c/code\u003e URI.\u003c/li\u003e\n\u003cli\u003eIf on Linux, the desktop environment processes the \u003ccode\u003e.desktop\u003c/code\u003e file and executes the embedded shell command, resulting in arbitrary code execution on the user's system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-55404 leads to arbitrary code execution on the affected user's system. This allows attackers to run any command, install malware, steal data, or further compromise the system with the privileges of the logged-in user. The impact is significant as it can lead to full system compromise without any overt signs of malicious activity beyond the user clicking a shortcut. All users of vulnerable yt-dlp versions who download content from untrusted sources with the specified options are at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003eyt-dlp\u003c/code\u003e to version 2026.07.04 or newer immediately to mitigate CVE-2026-55404.\u003c/li\u003e\n\u003cli\u003eIf immediate upgrade is not possible, advise users to avoid using the \u003ccode\u003e--write-link\u003c/code\u003e, \u003ccode\u003e--write-url-link\u003c/code\u003e, or \u003ccode\u003e--write-desktop-link\u003c/code\u003e options with \u003ccode\u003eyt-dlp\u003c/code\u003e, especially when downloading from untrusted sources.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detects CVE-2026-55404 Exploitation - Linux Desktop Shortcut Command Execution\u0026quot; to your SIEM and tune for your environment to identify suspicious shell command execution.\u003c/li\u003e\n\u003cli\u003eEnable \u003ccode\u003eprocess_creation\u003c/code\u003e logging for Linux endpoints to capture command-line arguments and parent process information necessary for the rule.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T20:36:37Z","date_published":"2026-07-24T20:36:37Z","id":"https://feed.craftedsignal.io/briefs/2026-07-yt-dlp-injection/","summary":"A high-severity command injection vulnerability, CVE-2026-55404, in yt-dlp versions prior to 2026.7.4 allows remote attackers to achieve arbitrary code execution by crafting malicious metadata that is improperly sanitized when generating Windows `.url` or Linux `.desktop` shortcut files, leading to remote executable execution or shell command injection upon user interaction.","title":"yt-dlp Shortcut Command Injection Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-yt-dlp-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:yt-Dlp_project:yt-Dlp:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}