How severe is CVE-2026-55404?

CVE-2026-55404 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-55404 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (35th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-55404?

CVE-2026-55404 affects Yt-dlp Project Yt-dlp. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-55404?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-55404 published?

CVE-2026-55404 was published on 2026-07-08 and last updated on 2026-07-13.

CVE-2026-55404

CVE-2026-55404 is a high-severity vulnerability in Yt-dlp Project Yt-dlp with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-74.

Key facts

Severity: High (CVSS 3.x base score 7.5)
EPSS exploit prediction: 0% (35th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-74
Affected product: Yt-dlp Project Yt-dlp
Published: 2026-07-08
Last modified: 2026-07-13

Description

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.

Frequently asked questions

What is CVE-2026-55404?: yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.
How severe is CVE-2026-55404?: CVE-2026-55404 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-55404 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (35th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-55404?: CVE-2026-55404 affects Yt-dlp Project Yt-dlp. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-55404?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-55404 published?: CVE-2026-55404 was published on 2026-07-08 and last updated on 2026-07-13.

References

Affected products (1)

cpe:2.3:a:yt-dlp_project:yt-dlp:*:*:*:*:*:*:*:*

More vulnerabilities in Yt-dlp Project Yt-dlp

CVE-2024-3566 — Critical (CVSS 9.8): A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly…
CVE-2026-26331 — High (CVSS 8.8): yt-dlp is a command-line audio/video downloader. Starting in version 2023.06.21 and prior to version 2026.02.21, when…
CVE-2026-50574 — High (CVSS 8.3): yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, if aria2c is used as an external downloader for a…
CVE-2026-50023 — High (CVSS 8.3): yt-dlp is a command-line audio/video downloader. Prior to 2026.06.09, a vulnerability exists in yt-dlp that allows a…
CVE-2024-22423 — High (CVSS 8.3): yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to…
CVE-2023-40581 — High (CVSS 8.3): yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines…

All CVEs affecting Yt-dlp Project Yt-dlp →

Other CWE-74 (Improper Neutralization of Special Elements (Injection)) vulnerabilities

CVE-2026-54159 — Critical (CVSS 10.0): PrestaShop ps_facetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the…
CVE-2026-44182 — Critical (CVSS 10.0): Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark,…
CVE-2026-25586 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty…
CVE-2026-25520 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped.…
CVE-2025-20265 — Critical (CVSS 10.0): A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could…
CVE-2025-20337 — Critical (CVSS 10.0): A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…

Browse all CWE-74 (Improper Neutralization of Special Elements (Injection)) vulnerabilities →