yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-139d3aad5f advisory.

    Automatic update for yt-dlp-2026.08.19-1.fc46.

    ##### **Changelog**

    ```
    * Thu Aug 20 2026 Mikel Olasagasti Uranga <mikel@olasagasti.info> - 2026.08.19-1
    - Update to 2026.08.19 - Closes rhbz#2497100 rhbz#2505367 rhbz#2491888       rhbz#2491889 rhbz#2491890 rhbz#2499189
    * Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2026.06.09-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c0410a0829 advisory.

    Automatic update for yt-dlp-2026.08.19-1.fc45.

    ##### **Changelog**

    ```
    * Thu Aug 20 2026 Mikel Olasagasti Uranga <mikel@olasagasti.info> - 2026.08.19-1
    - Update to 2026.08.19 - Closes rhbz#2497100 rhbz#2505367 rhbz#2491888       rhbz#2491889 rhbz#2491890 rhbz#2499189
    * Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2026.06.09-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The detected version of the yt-dlp Python package is prior to 2026.7.4. It is, therefore, affected by a command injection vulnerability. yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the
--write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link,
    --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using     attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing     malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can     execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.
    (CVE-2026-55404)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
338393	Fedora 46 : yt-dlp (2026-139d3aad5f)	Nessus	Fedora Local Security Checks	Local	critical
338382	Fedora 45 : yt-dlp (2026-c0410a0829)	Nessus	Fedora Local Security Checks	Local	critical
327412	Python Library yt-dlp < 2026.7.4 Command Injection	Nessus	Misc.	Local	high
326071	Linux Distros Unpatched Vulnerability : CVE-2026-55404	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-55404

high

Tenable Plugins

critical

critical

high

high