Upstream information

CVE-2026-55404 at MITRE

Description

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.

SUSE information

Overall state of this security issue: Does not affect SUSE products

No SUSE Bugzilla entries cross referenced.

No SUSE Security Announcements cross referenced.

List of released packages

Product(s) Fixed package version(s) References
openSUSE Tumbleweed
  • python313-yt-dlp >= 2026.07.04-1.1
  • yt-dlp >= 2026.07.04-1.1
  • yt-dlp-youtube-dl >= 2026.07.04-1.1
 Patchnames:
openSUSE-Tumbleweed-2026-11196

SUSE Timeline for this CVE

CVE page created: Tue Jul 7 11:36:49 2026
CVE page last modified: Thu Jul 9 11:30:37 2026