CyberRota Analysis
AI-GeneratedThe vulnerability affects yt-dlp and youtube-dl command-line tools on both Windows and Linux platforms, allowing the creation of malicious shortcut files through insufficient validation of user-controlled metadata. This can lead to file:// URI injection on Windows or newline-based key injection on Linux, potentially executing arbitrary commands when the shortcuts are opened. Users of these tools, especially those managing downloads in sensitive environments, should prioritize updating to version 2026.7.4 to mitigate the risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.
Related CVEs
Other vulnerabilities affecting the same vendor(s)