yt-dlp versions before 2026.5.8_1 have a vulnerability in the handling of the --write-link, --write-url-link, and --write-desktop-link options. Improper sanitization of metadata used in shortcut files (.url on Windows and .desktop on Linux) can lead to command injection. On Windows, a crafted file:// URI in the webpage_url can cause execution of remote executables when the .url file is opened. On Linux, disabling filename sanitization with --no-windows-filenames allows injection of arbitrary shell commands in .desktop files. This can lead to remote code execution if the user opens the crafted shortcut files.