yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22142-1 advisory.

    Changes in yt-dlp:

    Update to version 2026.08.19:

      * utils: float_or_none: Catch OverflowError
      * americastestkitchen: Fix season/series extraction
      * apple: Rework extractors
      * ard: Remove dead extractor
      * bandcamp: Support browser impersonation
      * bfmtv: Fix extractor
      * instagram: Fix logged-in extraction
      * showroom: Rework extractors
      * tiktok: Fix extractor
      * tiktok: Fix formats extraction
      * tiktok: Support share URLs
      * twitter: broadcast: Fix events handling
      * vimeo: Remove ios and macos clients
      * whyp: Fix extractor
      * youtube: Add visionos player client
      * youtube: Add web_embedded client fallbacks
      * youtube: Extract channel_follower_count for collaborators
      * youtube: Fix live adaptive fragments generation
      * youtube: Remove android_vr from default clients
      * youtube: tab: Always extract channel metadata
      * hls: Fix crash on empty fragment lists in tests

    Update to version 2026.07.04:

      * The minimum recommended Python version has been raised to         3.11
      * Security: [CVE-2026-55404 bsc#1286026] Downstream command injection via         improper sanitization of --write-link output
      * Shortcut file data is now properly validated and sanitized         when the --write-link options are used
      * Always include warnings in debug output
      * Fix allow-unsafe-ext compat option
      * Raise minimum recommended Python version to 3.11
      * Validate and escape values in --write-link output
      * cookies: Use ' instead of  for SQL string quoting
      * utils: Deprecate make_dir in favor of make_parent_dirs
      * utils: HTTPHeaderDict: Fix __ior__
      * utils: parse_duration: Return int when appropriate
      * utils: parse_resolution: Support fps suffixes
      * utils: pkcs1pad: Fix invalid PKCS#1 v1.5 padding bytes
      * utils: qualities: Avoid repeated index lookups
      * utils: random_user_agent: Bump version range 143-149 =>         144-150
      * Always include id in request error output
      * Fix request logging
      * arte: Fix playlist support
      * bandcamp: weekly: Fix extractor
      * bilibili: Fix API extraction
      * instagram: Detect when cookies are invalidated
      * instagram: Rework extractor
      * linkedin: Remove broken login support
      * mgtv: Fix VIP stream extraction
      * mxplayer: Fix extractors
      * mxplayer: Rework extractors
      * niconico: Fix error detection
      * niconico: Support shorts
      * omnyfm: Add extractors
      * openrec: Rework extractors
      * patreon: Support new URL format
      * peertube: Support password-protected videos
      * periscope: Improve metadata extraction
      * reddit: Remove broken login support
      * soundcloud: Extract uploader_url for playlists
      * soundcloud: Extract comments
      * soundcloud: Improve metadata extraction
      * streaks: Fix extractor
      * svt: Fix extractor
      * telewebion: Fix extractor
      * trovo: Remove dead extractors
      * truth: Support share URLs
      * tviplayer: Fix extractor
      * unsupported: Update unsupported sites
      * wrestleuniverse: vod: Fix extractor
      * youtube: Fix extract_relative_time for abbreviated units
      * youtube: Fix detection of forced preroll wait time
      * youtube: Fix minor issues
      * youtube: Support live adaptive formats
      * tab: Fix flat extraction of collaborators
      * tab: Fix flat playlist metadata extraction
      * tab: Fix metadata extraction
      * tab: Fix pagination
      * zan: Add extractor
      * zdf: Detect livestreams
      * zoom: clips: Add extractor
      * external: Fix resuming downloads with aria2c
      * external: curl: Support development versions
      * mhtml: Fix storyboard content-length calculation
      * build: Update 17 dependencies
      * build: Update 6 dependencies
      * cleanup: Fix invalid info dict fields
      * cleanup: Fix minor mistakes
      * cleanup: Remove RTSP and MMS support
      * cleanup: Replace dead example/test URL
      * cleanup: Miscellaneous: 997fa14
      * docs: Make No AI / No LLM Policy abundantly clear

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the cd5bfb7d-ac34-11f1-9b94-901b0e13f1a0 advisory.

    https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-6v4j-43gg-vj32 reports:
    yt-dlp and youtube-dl are command-line audio/video downloaders.
            Prior to 2026.7.4, the --write-link, --write-url-link, and
            --write-desktop-link options can write .url or .desktop shortcut             files using attacker-controlled webpage_url or filename metadata             without sufficient validation or escaping, allowing malicious             file:// URI injection on Windows or newline-based desktop             entry key injection on Linux that can execute commands if             the generated shortcut is             opened. This issue is fixed in version 2026.7.4.


Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-139d3aad5f advisory.

    Automatic update for yt-dlp-2026.08.19-1.fc46.

    ##### **Changelog**

    ```
    * Thu Aug 20 2026 Mikel Olasagasti Uranga <mikel@olasagasti.info> - 2026.08.19-1
    - Update to 2026.08.19 - Closes rhbz#2497100 rhbz#2505367 rhbz#2491888       rhbz#2491889 rhbz#2491890 rhbz#2499189
    * Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2026.06.09-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c0410a0829 advisory.

    Automatic update for yt-dlp-2026.08.19-1.fc45.

    ##### **Changelog**

    ```
    * Thu Aug 20 2026 Mikel Olasagasti Uranga <mikel@olasagasti.info> - 2026.08.19-1
    - Update to 2026.08.19 - Closes rhbz#2497100 rhbz#2505367 rhbz#2491888       rhbz#2491889 rhbz#2491890 rhbz#2499189
    * Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2026.06.09-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The detected version of the yt-dlp Python package is prior to 2026.7.4. It is, therefore, affected by a command injection vulnerability. yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the
--write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link,
    --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using     attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing     malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can     execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.
    (CVE-2026-55404)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
370419	openSUSE 16 Security Update : yt-dlp (openSUSE-SU-2026:22142-1)	Nessus	SuSE Local Security Checks	Local	high
345446	FreeBSD : yt-dlp: Improper Neutralization of Special Elements (cd5bfb7d-ac34-11f1-9b94-901b0e13f1a0)	Nessus	FreeBSD Local Security Checks	Local	high
338393	Fedora 46 : yt-dlp (2026-139d3aad5f)	Nessus	Fedora Local Security Checks	Local	critical
338382	Fedora 45 : yt-dlp (2026-c0410a0829)	Nessus	Fedora Local Security Checks	Local	critical
327412	Python Library yt-dlp < 2026.7.4 Command Injection	Nessus	Misc.	Local	high
326071	Linux Distros Unpatched Vulnerability : CVE-2026-55404	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-55404

high

Tenable Plugins

high

high

critical

critical

high

high