yt-dlp versions 3.0.0 through 3.0.6 have a vulnerability in the handling of shortcut files generated by the --write-link, --write-url-link, and --write-desktop-link options. Improper sanitization of metadata used in these shortcuts can lead to downstream command injection. On Windows, a malicious file:// URI in the webpage_url can cause execution of remote executables when the .url file is opened. On Linux, if the --no-windows-filenames option is used, unsanitized filenames with newline characters can inject arbitrary commands into .desktop files, leading to shell command execution when opened. This vulnerability is fixed in version 3.0.7.