CVE-2026-55404 yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpageurl or filename metadata without sufficient validation or escaping,...

CVE-2026-55404

YT-dlp and YouTube-dl before 2026.7.4 expose a vulnerability through --write-link, --write-url-link, and --write-desktop-link that can write .url/.desktop shortcuts using attacker-controlled metadata, enabling file:// URI or desktop entry key injection and potential command execution when opened....

CVE-2026-55404 yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpageurl or filename metadata without sufficient validation or escaping,...

CVE-2026-55404 yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

yt-dlp and youtube-dl are command-line audio/video downloaders. Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpageurl or filename metadata without sufficient validation or escaping,...

CVE-2026-59922

creationtimestamp| type| source ---|---|--- 2026-07-08 19:36:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5ujo2lbl2q 2026-07-20 22:35:27+00:00| published-proof-of-concept| https://github.com/lepture/mistune/security/advisories/GHSA-c8j7-8cv4-2xmq...

CVE-2026-59926

creationtimestamp| type| source ---|---|--- 2026-07-08 19:32:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5ucwsjg62g...

CVE-2026-59883

creationtimestamp| type| source ---|---|--- 2026-07-08 19:23:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5tsoicmx2x 2026-07-13 17:48:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqkatpltbc2e 2026-07-16 08:03:53+00:00| seen|...

CVE-2026-59887

creationtimestamp| type| source ---|---|--- 2026-07-08 19:21:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5to6wxdf2t 2026-07-09 05:02:17+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mq6u5ij4ws2n 2026-07-21 20:35:13+00:00| published-proof-of-concept|...

CVE-2026-0278

creationtimestamp| type| source ---|---|--- 2026-07-08 19:03:37+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mq5sp4zwv22m 2026-07-10 00:15:02+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-0278...

CVE-2026-0286

creationtimestamp| type| source ---|---|--- 2026-07-08 19:03:22+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mq5soorub227 2026-07-09 04:46:28+00:00| seen| https://www.hkcert.org/security-bulletin/palo-alto-products-multiple-vulnerabilities20260709 2026-07-09 20:59:24+00:00| seen...

CVE-2018-13010

creationtimestamp| type| source ---|---|--- 2026-07-08 18:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq5r7q3y3426...

CVE-2026-29008

creationtimestamp| type| source ---|---|--- 2026-07-08 17:40:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5o36xfaw2x 2026-07-09 00:02:04+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mq6desj6rx2c...

CVE-2026-59928

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/blockparser.py and the reflinks environment dictionary handling, allowing denial of service...

CVE-2026-39822

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symbolic link pointing...

CVE-2026-12002

creationtimestamp| type| source ---|---|--- 2026-07-08 17:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mq5mov46i522...

CVE-2026-59873

creationtimestamp| type| source ---|---|--- 2026-07-08 16:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq5kohrtec2b 2026-07-08 17:44:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5ob632iw2e 2026-07-11 03:37:07+00:00| seen|...

CVE-2026-59702

creationtimestamp| type| source ---|---|--- 2026-07-08 16:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq5kogjzv52f 2026-07-08 18:12:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5ptfkrs52x 2026-07-10 23:51:43+00:00| seen|...

CVE-2026-56298

creationtimestamp| type| source ---|---|--- 2026-07-08 16:37:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5kj564gz27...

CVE-2026-56360

creationtimestamp| type| source ---|---|--- 2026-07-08 16:22:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5jpigfx22w...

CVE-2026-10699

creationtimestamp| type| source ---|---|--- 2026-07-08 16:19:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq5jirczea2i 2026-07-08 20:15:09+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/progress-security-advisory-av26-678 2026-07-10 19:04:20+00:00| seen|...