yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the cd5bfb7d-ac34-11f1-9b94-901b0e13f1a0 advisory.

    https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-6v4j-43gg-vj32 reports:
    yt-dlp and youtube-dl are command-line audio/video downloaders.
            Prior to 2026.7.4, the --write-link, --write-url-link, and
            --write-desktop-link options can write .url or .desktop shortcut             files using attacker-controlled webpage_url or filename metadata             without sufficient validation or escaping, allowing malicious             file:// URI injection on Windows or newline-based desktop             entry key injection on Linux that can execute commands if             the generated shortcut is             opened. This issue is fixed in version 2026.7.4.


Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-139d3aad5f advisory.

    Automatic update for yt-dlp-2026.08.19-1.fc46.

    ##### **Changelog**

    ```
    * Thu Aug 20 2026 Mikel Olasagasti Uranga <mikel@olasagasti.info> - 2026.08.19-1
    - Update to 2026.08.19 - Closes rhbz#2497100 rhbz#2505367 rhbz#2491888       rhbz#2491889 rhbz#2491890 rhbz#2499189
    * Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2026.06.09-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c0410a0829 advisory.

    Automatic update for yt-dlp-2026.08.19-1.fc45.

    ##### **Changelog**

    ```
    * Thu Aug 20 2026 Mikel Olasagasti Uranga <mikel@olasagasti.info> - 2026.08.19-1
    - Update to 2026.08.19 - Closes rhbz#2497100 rhbz#2505367 rhbz#2491888       rhbz#2491889 rhbz#2491890 rhbz#2499189
    * Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2026.06.09-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The detected version of the yt-dlp Python package is prior to 2026.7.4. It is, therefore, affected by a command injection vulnerability. yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the
--write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link,
    --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using     attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing     malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can     execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.
    (CVE-2026-55404)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
345446	FreeBSD : yt-dlp: Improper Neutralization of Special Elements (cd5bfb7d-ac34-11f1-9b94-901b0e13f1a0)	Nessus	FreeBSD Local Security Checks	Local	high
338393	Fedora 46 : yt-dlp (2026-139d3aad5f)	Nessus	Fedora Local Security Checks	Local	critical
338382	Fedora 45 : yt-dlp (2026-c0410a0829)	Nessus	Fedora Local Security Checks	Local	critical
327412	Python Library yt-dlp < 2026.7.4 Command Injection	Nessus	Misc.	Local	high
326071	Linux Distros Unpatched Vulnerability : CVE-2026-55404	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-55404

high

Tenable Plugins

high

critical

critical

high

high