https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 11:01:07 +0000 https://cve.radiocsirt.org/vuln/brew-gamdl-cve-2026-55404 <p><strong>Affected:</strong> Homebrew: gamdl</p> <p>### Summary If the `--write-link`, `--write-url-link` or `--write-desktop-link` options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the `.url` and `.desktop` shortcut files written by yt-dlp. This allows for malicious shell commands or malicious remote executables to run on the user&#39;s system if the user executes the generated `.url` or `.desktop` files.</p> <p>### Details The expected result of yt-dlp&#39;s `--write-link`, `--write-url-link` and `--write-desktop-link` options is to write a shortcut file that points to the webpage URL for the content downloaded by yt-dlp. The `--write-url-link` option writes a `.url` shortcut file for Windows, the `--write-desktop-link` option writes a `.desktop` shortcut file for Linux, and the `--write-link` option may write a `.url` file or a `.desktop` file depending on the user&#39;s platform.</p> <p>There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp&#39;s improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files.</p> <p>#### Scenario 1: `file://` URI injection in Windows `.url` shortcut</p> <p>If a yt-dlp user passes the `--write-link` or `--write-url-link` option to generate a Windows `.url` file, the URL written to the shortcut file is sourced from the downloaded media&#39;s metadata--specifically, its…</p> <p><strong>Affected:</strong> Homebrew: gamdl</p> <p>### Summary If the `--write-link`, `--write-url-link` or `--write-desktop-link` options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the `.url` and `.desktop` shortcut files written by yt-dlp. This allows for malicious shell commands or malicious remote executables to run on the user&#39;s system if the user executes the generated `.url` or `.desktop` files.</p> <p>### Details The expected result of yt-dlp&#39;s `--write-link`, `--write-url-link` and `--write-desktop-link` options is to write a shortcut file that points to the webpage URL for the content downloaded by yt-dlp. The `--write-url-link` option writes a `.url` shortcut file for Windows, the `--write-desktop-link` option writes a `.desktop` shortcut file for Linux, and the `--write-link` option may write a `.url` file or a `.desktop` file depending on the user&#39;s platform.</p> <p>There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp&#39;s improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files.</p> <p>#### Scenario 1: `file://` URI injection in Windows `.url` shortcut</p> <p>If a yt-dlp user passes the `--write-link` or `--write-url-link` option to generate a Windows `.url` file, the URL written to the shortcut file is sourced from the downloaded media&#39;s metadata--specifically, its…</p> https://cve.radiocsirt.org/vuln/brew-gamdl-cve-2026-55404 https://cve.radiocsirt.org/vuln/euvd-2026-335373 EUVD-2026-335373 https://cve.radiocsirt.org/vuln/euvd-2026-335373 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55404 <p>yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.</p> <p>yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55404 https://cve.radiocsirt.org/vuln/ghsa-6v4j-43gg-vj32 <p><strong>Affected:</strong> PyPI: yt-dlp</p> <p>### Summary If the `--write-link`, `--write-url-link` or `--write-desktop-link` options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the `.url` and `.desktop` shortcut files written by yt-dlp. This allows for malicious shell commands or malicious remote executables to run on the user&#39;s system if the user executes the generated `.url` or `.desktop` files.</p> <p>### Details The expected result of yt-dlp&#39;s `--write-link`, `--write-url-link` and `--write-desktop-link` options is to write a shortcut file that points to the webpage URL for the content downloaded by yt-dlp. The `--write-url-link` option writes a `.url` shortcut file for Windows, the `--write-desktop-link` option writes a `.desktop` shortcut file for Linux, and the `--write-link` option may write a `.url` file or a `.desktop` file depending on the user&#39;s platform.</p> <p>There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp&#39;s improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files.</p> <p>#### Scenario 1: `file://` URI injection in Windows `.url` shortcut</p> <p>If a yt-dlp user passes the `--write-link` or `--write-url-link` option to generate a Windows `.url` file, the URL written to the shortcut file is sourced from the downloaded media&#39;s metadata--specifically, its…</p> <p><strong>Affected:</strong> PyPI: yt-dlp</p> <p>### Summary If the `--write-link`, `--write-url-link` or `--write-desktop-link` options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the `.url` and `.desktop` shortcut files written by yt-dlp. This allows for malicious shell commands or malicious remote executables to run on the user&#39;s system if the user executes the generated `.url` or `.desktop` files.</p> <p>### Details The expected result of yt-dlp&#39;s `--write-link`, `--write-url-link` and `--write-desktop-link` options is to write a shortcut file that points to the webpage URL for the content downloaded by yt-dlp. The `--write-url-link` option writes a `.url` shortcut file for Windows, the `--write-desktop-link` option writes a `.desktop` shortcut file for Linux, and the `--write-link` option may write a `.url` file or a `.desktop` file depending on the user&#39;s platform.</p> <p>There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp&#39;s improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files.</p> <p>#### Scenario 1: `file://` URI injection in Windows `.url` shortcut</p> <p>If a yt-dlp user passes the `--write-link` or `--write-url-link` option to generate a Windows `.url` file, the URL written to the shortcut file is sourced from the downloaded media&#39;s metadata--specifically, its…</p> https://cve.radiocsirt.org/vuln/ghsa-6v4j-43gg-vj32 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11196-1 <p>python313-yt-dlp-2026.07.04-1.1 on GA media</p> <p>python313-yt-dlp-2026.07.04-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11196-1 https://cve.radiocsirt.org/vuln/pysec-2026-3622 <p><strong>Affected:</strong> PyPI: yt-dlp</p> <p>### Summary If the `--write-link`, `--write-url-link` or `--write-desktop-link` options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the `.url` and `.desktop` shortcut files written by yt-dlp. This allows for malicious shell commands or malicious remote executables to run on the user&#39;s system if the user executes the generated `.url` or `.desktop` files.</p> <p>### Details The expected result of yt-dlp&#39;s `--write-link`, `--write-url-link` and `--write-desktop-link` options is to write a shortcut file that points to the webpage URL for the content downloaded by yt-dlp. The `--write-url-link` option writes a `.url` shortcut file for Windows, the `--write-desktop-link` option writes a `.desktop` shortcut file for Linux, and the `--write-link` option may write a `.url` file or a `.desktop` file depending on the user&#39;s platform.</p> <p>There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp&#39;s improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files.</p> <p>#### Scenario 1: `file://` URI injection in Windows `.url` shortcut</p> <p>If a yt-dlp user passes the `--write-link` or `--write-url-link` option to generate a Windows `.url` file, the URL written to the shortcut file is sourced from the downloaded media&#39;s metadata--specifically, its…</p> <p><strong>Affected:</strong> PyPI: yt-dlp</p> <p>### Summary If the `--write-link`, `--write-url-link` or `--write-desktop-link` options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the `.url` and `.desktop` shortcut files written by yt-dlp. This allows for malicious shell commands or malicious remote executables to run on the user&#39;s system if the user executes the generated `.url` or `.desktop` files.</p> <p>### Details The expected result of yt-dlp&#39;s `--write-link`, `--write-url-link` and `--write-desktop-link` options is to write a shortcut file that points to the webpage URL for the content downloaded by yt-dlp. The `--write-url-link` option writes a `.url` shortcut file for Windows, the `--write-desktop-link` option writes a `.desktop` shortcut file for Linux, and the `--write-link` option may write a `.url` file or a `.desktop` file depending on the user&#39;s platform.</p> <p>There are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp&#39;s improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files.</p> <p>#### Scenario 1: `file://` URI injection in Windows `.url` shortcut</p> <p>If a yt-dlp user passes the `--write-link` or `--write-url-link` option to generate a Windows `.url` file, the URL written to the shortcut file is sourced from the downloaded media&#39;s metadata--specifically, its…</p> https://cve.radiocsirt.org/vuln/pysec-2026-3622 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-55404 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: youtube-dl, Ubuntu:18.04:LTS: youtube-dl, Ubuntu:20.04:LTS: youtube-dl, Ubuntu:22.04:LTS: youtube-dl, Ubuntu:22.04:LTS: yt-dlp, Ubuntu:24.04:LTS: yt-dlp, Ubuntu:25.10: yt-dlp, Ubuntu:26.04:LTS: yt-dlp</p> <p>yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: youtube-dl, Ubuntu:18.04:LTS: youtube-dl, Ubuntu:20.04:LTS: youtube-dl, Ubuntu:22.04:LTS: youtube-dl, Ubuntu:22.04:LTS: yt-dlp, Ubuntu:24.04:LTS: yt-dlp, Ubuntu:25.10: yt-dlp, Ubuntu:26.04:LTS: yt-dlp</p> <p>yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-55404