PT-2026-55745 · Yt-Dlp · Yt-Dlp

Published 2026-07-04 · Updated 2026-07-08 · CVE-2026-55404

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions yt-dlp versions prior to 2026.07.04

Description Improper sanitization of output when using the --write-link option allows for downstream command injection. This occurs because shortcut file data is not properly validated and sanitized before being processed.

Recommendations Update yt-dlp to version 2026.07.04 or later. As a temporary workaround, avoid using the --write-link option until the software is updated.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2026-55404

OPENSUSE-SU-2026:11196-1

Affected Products

Yt-Dlp

References · 7

• https://osv.dev/vulnerability/openSUSE-SU-2026:11196-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-55404 · Security Note
• https://github.com/yt-dlp/yt-dlp/commit/b6590aaa1e3808155d69c9a79a797ae484163789 · Note
• https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-6v4j-43gg-vj32 · Note
• https://github.com/yt-dlp/yt-dlp/releases/tag/2026.07.04 · Note
• https://suse.com/security/cve/CVE-2026-55404 · Note
• https://reddit.com/r/youtubedl/comments/1unmgsk/ytdlp_release_20260704 · Reddit Post