The vulnerability in yt‑dlp’s shortcut‑generating options permits command injection by writing .url or .desktop files that contain attacker‑controlled metadata. Because the program does not properly escape the webpage_url or filename fields, an attacker can insert a file:// URI on Windows or a newline in a Linux desktop file that leads to arbitrary command execution when the file is opened. CWE‑74 describes this type of malicious unsanitized input.

The flaw affects yt‑dlp prior to release 2026.7.4. Any user that runs download commands with the --write-link, --write-url-link, or --write-desktop-link flags while using an unpatched version is vulnerable. The issue applies to both Windows and Linux operating systems.

The CVSS base score is 7.5, indicating a high impact. The EPSS score is below 1%, indicating a low, but non‑zero, exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it has not been widely exploited in the wild. Exploitation requires that the attacker creates a shortcut file with malicious metadata and that a privileged or normal user opens that file, so the attack vector is local. If executed, the injected command runs with the privileges of the user who opens the shortcut.