Python Library yt-dlp < 2026.7.4 Command Injection

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(327412);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/17");

  script_cve_id("CVE-2026-55404");
  script_xref(name:"IAVB", value:"2026-B-0194");

  script_name(english:"Python Library yt-dlp < 2026.7.4 Command Injection");

  script_set_attribute(attribute:"synopsis", value:
"A Python library installed on the remote host is affected by a command injection vulnerability.");
  script_set_attribute(attribute:"description", value:
"The detected version of the yt-dlp Python package is prior to 2026.7.4. It is, therefore, affected by a command
injection vulnerability. yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the
--write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using
attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious
file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if
the generated shortcut is opened.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-6v4j-43gg-vj32
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b24d747d");
  script_set_attribute(attribute:"solution", value:
"Upgrade to yt-dlp version 2026.7.4 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-55404");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:yt-dlp_project:yt-dlp");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("python_packages_installed_nix.nbin", "python_packages_win_installed.nbin");
  script_require_ports("Host/nix/Python/Packages/Enumerated", "Host/win/Python/Packages/Enumerated");

  exit(0);
}

include('python.inc');

var pkg = 'yt-dlp';

var libs = python::get_package_info(pkg_name:pkg, cpe:"cpe:/a:yt-dlp_project:yt-dlp");

if (empty_or_null(libs))
  audit(AUDIT_NOT_INST, pkg);

vcf::check_all_backporting(app_info:libs);

var constraints = [
  { 'fixed_version' : '2026.7.4' }
];

vcf::check_version_and_report(
  app_info:libs,
  constraints:constraints,
  severity:SECURITY_HOLE
);