A command injection vulnerability exists in yt-dlp when using the --write-link, --write-url-link, or --write-desktop-link options. Improper sanitization of metadata values can lead to malicious shortcut files (.url on Windows and .desktop on Linux) that execute arbitrary commands when opened by the user. This affects certain versions of the moodle-dl product that bundle yt-dlp. The vulnerability has a high severity with a CVSS score of 8.8. A patch is available to address this issue.