yt-dlp and youtube-dl are command-line tools for downloading audio and video. Versions prior to 2026.7.4 have a vulnerability in the --write-link, --write-url-link, and --write-desktop-link options, which write shortcut files (.url or .desktop) using metadata fields that can be attacker-controlled. Insufficient validation or escaping of these fields allows injection of malicious file:// URIs on Windows or newline-based key injection in Linux desktop entries. This can result in arbitrary command execution if the generated shortcut file is opened by the user. The vulnerability is resolved in version 2026.7.4.

Successful exploitation allows an attacker to craft shortcut files that execute arbitrary commands when opened by the user, leading to potential full compromise of the affected system. The vulnerability affects both Windows and Linux platforms via different injection techniques. The CVSS vector indicates network attack vector with high impact on confidentiality, integrity, and availability, but requires user interaction and has high attack complexity.

This vulnerability is fixed in yt-dlp and youtube-dl version 2026.7.4. Users should upgrade to version 2026.7.4 or later to remediate this issue. No other mitigations are indicated by the vendor advisory.