{"id":"PYSEC-2026-3622","summary":"yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output","details":"### Summary\nIf the `--write-link`, `--write-url-link` or `--write-desktop-link` options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the `.url` and `.desktop` shortcut files written by yt-dlp. This allows for malicious shell commands or malicious remote executables to run on the user's system if the user executes the generated `.url` or `.desktop` files.\n\n### Details\nThe expected result of yt-dlp's `--write-link`, `--write-url-link` and `--write-desktop-link` options is to write a shortcut file that points to the webpage URL for the content downloaded by yt-dlp. The `--write-url-link` option writes a `.url` shortcut file for Windows, the `--write-desktop-link` option writes a `.desktop` shortcut file for Linux, and the `--write-link` option may write a `.url` file or a `.desktop` file depending on the user's platform.\n\nThere are two known scenarios where a remote attacker could serve a malicious metadata payload to exploit yt-dlp's improper validation/sanitization of its shortcut output and achieve arbitrary code execution if the user later opens these files.\n\n#### Scenario 1: `file://` URI injection in Windows `.url` shortcut\n\nIf a yt-dlp user passes the `--write-link` or `--write-url-link` option to generate a Windows `.url` file, the URL written to the shortcut file is sourced from the downloaded media's metadata--specifically, its `webpage_url` value. This value is commonly a normalized version of the input URL passed to yt-dlp by the user, but in some cases it may be extracted from untrusted web input. Validation of this `webpage_url` value is performed if it is fed back to yt-dlp as an input URL (e.g. via the `--load-info-json` option), but no validation is performed before it is output to a `.url` shortcut file.\n\nThis lack of validation is exploitable by a remote attacker who crafts a malicious metadata payload such that the resulting `webpage_url` value is a `file://` URI. A malicious file URI could point to a remote executable, e.g. `file://example.org/pwned.exe`. If a Windows user double-clicks a `.url` file that points to this `webpage_url`, Windows will execute the malicious remote executable on the user's system.\n\n#### Scenario 2: Shell command injection in Linux `.desktop` shortcut\n\nThe Linux `.desktop` file format is a more versatile than the Windows `.url` file format. It is defined by the freedesktop.org \"desktop entry\" file specification, and supports multiple types of shortcuts: a `Link` type for URLs, a `Directory` type for filesystem folders, and an `Application` type for programs or shell commands. yt-dlp outputs a desktop entry file of the `Link` type, using the template below:\n\n```desktop\n[Desktop Entry]\nEncoding=UTF-8\nName=%(filename)s\nType=Link\nURL=%(url)s\nIcon=text-html\n```\n\nThe keys under the `[Desktop Entry]` group are separated by newlines, and the type of desktop entry is set by the value paired to the `Type` key.\n\nIf a yt-dlp user passes the `--write-link` or `--write-desktop-link` option to generate a desktop entry file, in addition to the `webpage_url` value there is a `filename` value that is written to the shortcut file. By default, yt-dlp will sanitize the `filename` value: this sanitization includes replacing newlines with spaces and removing other control characters. However, the `--no-windows-filenames` option was modified in yt-dlp version 2024.12.23 to disable this default filename sanitization when used. \n\nIf the user passes `--write-link` or `--write-desktop-link` together with `--no-windows-filenames` to yt-dlp, an unsanitized `filename` value can be written to the resulting desktop entry file. A remote attacker can exploit this lack of sanitization by crafting a malicious metadata payload such that the resulting `filename` value contains newline characters, which can be used to inject arbitrary groups, keys and values into the desktop entry output. Doing so allows the attacker to change the `Type` of the desktop entry to `Application` and achieve shell command injection.\n\nFor example, an attacker-controlled website could serve a webpage with this maliciously crafted JSON-LD data:\n\n```html\n\u003chtml\u003e\n\u003cscript type=\"application/ld+json\"\u003e{\n    \"@context\": \"https://schema.org\",\n    \"@type\": \"VideoObject\",\n    \"name\":\"Stream\\nType=Application\\nExec=sh -c "touch /tmp/pwned"\\n\\n[newgroup]\\nName=endtitle\",\n    \"contentUrl\": \"https://example.org/video.mp4\"\n}\u003c/script\u003e\n\u003c/html\u003e\n```\n\nThen, a yt-dlp user could try to download the legitimate video content from the page by running the following command:\n\n```bash\nyt-dlp --write-desktop-link --no-windows-filenames \"https://example.org/123\"\n```\n\nWhich would result in a desktop entry file containing a malicious shell command:\n\n```desktop\n[Desktop Entry]\nEncoding=UTF-8\nName=Stream\nType=Application\nExec=sh -c \"touch /tmp/pwned\"\n\n[newgroup]\nName=endtitle [123]\nType=Link\nURL=%(url)s\nIcon=text-html\n```\n\nIf a user on a Linux desktop environment executes the generated `.desktop` file, the malicious shell command would run on the user's system. (In the above example, a `/tmp/pwned` file would be created in the user's filesystem.)\n\n### Patches\nyt-dlp version 2026.07.04 fixes this issue by validating the URL scheme before any shortcut file is written, and by properly sanitizing all desktop entry values written to the `.desktop` file generated from using the `--write-desktop-link` or `--write-link` options. (Most notably: newline characters are replaced by their proper escape sequence per the freedesktop.org desktop entry specification.)\n\n### Workarounds\nIt is recommended to upgrade yt-dlp to version 2026.07.04 as soon as possible.\n\nUsers who are not able to upgrade should avoid using any of the `--write-link`, `--write-url-link` or `--write-desktop-link` options.","aliases":["CVE-2026-55404","GHSA-6v4j-43gg-vj32"],"modified":"2026-08-04T14:30:20.327615Z","published":"2026-08-04T11:34:43.163955Z","references":[{"type":"WEB","url":"https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-6v4j-43gg-vj32"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55404"},{"type":"WEB","url":"https://github.com/yt-dlp/yt-dlp/commit/6fc85f617a5850307fd5b258477070e6ee177796"},{"type":"WEB","url":"https://github.com/yt-dlp/yt-dlp/commit/b6590aaa1e3808155d69c9a79a797ae484163789"},{"type":"PACKAGE","url":"https://github.com/yt-dlp/yt-dlp"},{"type":"WEB","url":"https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2026.07.04.221833"},{"type":"WEB","url":"https://github.com/yt-dlp/yt-dlp/releases/tag/2026.07.04"},{"type":"PACKAGE","url":"https://pypi.org/project/yt-dlp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6v4j-43gg-vj32"}],"affected":[{"package":{"name":"yt-dlp","ecosystem":"PyPI","purl":"pkg:pypi/yt-dlp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2026.7.4"}]}],"versions":["2021.1.15","2021.1.15.post1","2021.1.16","2021.1.20","2021.1.24","2021.1.24.post1","2021.1.29","2021.10.10","2021.10.22","2021.10.9","2021.11.10","2021.11.10.1","2021.12.1","2021.12.25","2021.12.27","2021.2.15","2021.2.19","2021.2.24","2021.2.4","2021.2.9","2021.3.1","2021.3.15","2021.3.21","2021.3.24","2021.3.24.1","2021.3.3","2021.3.3.1","2021.3.3.2","2021.3.7","2021.4.11","2021.4.22","2021.4.3","2021.5.11","2021.5.20","2021.6.1","2021.6.23","2021.6.8","2021.6.9","2021.7.21","2021.7.24","2021.7.7","2021.8.10","2021.8.2","2021.9.1","2021.9.2","2021.9.25","2022.1.21","2022.10.4","2022.11.11","2022.2.3","2022.2.4","2022.3.8","2022.3.8.1","2022.3.8.2","2022.4.8","2022.5.18","2022.6.22","2022.6.22.1","2022.6.29","2022.7.17","2022.7.18","2022.8.14","2022.8.19","2022.8.8","2022.9.1","2023.1.2","2023.1.6","2023.10.13","2023.10.7","2023.11.13.232715.dev0","2023.11.13.5826.dev0","2023.11.14","2023.11.15.232826.dev0","2023.11.16","2023.11.16.232727.dev0","2023.11.18.232705.dev0","2023.11.19.232719.dev0","2023.11.20.232729.dev0","2023.11.26.232703.dev0","2023.11.28.232715.dev0","2023.11.29.232714.dev0","2023.12.12.232727.dev0","2023.12.13.232710.dev0","2023.12.17.232710.dev0","2023.12.18.232711.dev0","2023.12.19.232701.dev0","2023.12.20.232717.dev0","2023.12.21.232720.dev0","2023.12.22.232735.dev0","2023.12.24.232657.dev0","2023.12.26.232752.dev0","2023.12.30","2023.12.30.232719.dev0","2023.12.31.232713.dev0","2023.12.5.232702.dev0","2023.12.6.232721.dev0","2023.2.17","2023.3.3","2023.3.4","2023.6.21","2023.6.22","2023.7.6","2023.9.24","2024.1.14.232710.dev0","2024.1.18.232658.dev0","2024.1.19.232708.dev0","2024.1.2.232714.dev0","2024.1.20.232722.dev0","2024.1.21.232719.dev0","2024.1.22.232713.dev0","2024.1.23.232723.dev0","2024.1.28.232706.dev0","2024.1.29.232706.dev0","2024.1.31.232703.dev0","2024.1.5.232702.dev0","2024.1.8.232709.dev0","2024.1.9.232723.dev0","2024.10.1.232843.dev0","2024.10.10.232848.dev0","2024.10.11.232837.dev0","2024.10.12.232856.dev0","2024.10.13.232959.dev0","2024.10.14.232841.dev0","2024.10.15.232919.dev0","2024.10.16.232911.dev0","2024.10.19.232833.dev0","2024.10.20.232914.dev0","2024.10.22","2024.10.22.232922.dev0","2024.10.22.51025.dev0","2024.10.23.232902.dev0","2024.10.24.232910.dev0","2024.10.25.232902.dev0","2024.10.26.232826.dev0","2024.10.27.232921.dev0","2024.10.28.232846.dev0","2024.10.29.232854.dev0","2024.10.31.232951.dev0","2024.10.7","2024.10.7.232845.dev0","2024.11.10.232816.dev0","2024.11.11.232805.dev0","2024.11.12.232900.dev0","2024.11.15.232903.dev0","2024.11.16.232922.dev0","2024.11.17.232856.dev0","2024.11.18","2024.11.18.232921.dev0","2024.11.2.232942.dev0","2024.11.23.232923.dev0","2024.11.24.232931.dev0","2024.11.26.232922.dev0","2024.11.27.232921.dev0","2024.11.3.232912.dev0","2024.11.4","2024.11.4.232933.dev0","2024.11.6.232826.dev0","2024.11.9.232836.dev0","2024.12.1.232904.dev0","2024.12.12.232950.dev0","2024.12.13","2024.12.13.232928.dev0","2024.12.15.232913.dev0","2024.12.2.233010.dev0","2024.12.23","2024.12.23.232812.dev0","2024.12.26.232815.dev0","2024.12.3","2024.12.3.232932.dev0","2024.12.4.232942.dev0","2024.12.6","2024.12.6.161513.dev0","2024.2.13.232701.dev0","2024.2.14.232704.dev0","2024.2.15.232705.dev0","2024.2.16.232705.dev0","2024.2.17.232706.dev0","2024.2.18.232707.dev0","2024.2.19.232703.dev0","2024.2.2.232707.dev0","2024.2.20.232712.dev0","2024.2.21.232721.dev0","2024.2.22.232849.dev0","2024.2.23.232656.dev0","2024.2.24.232815.dev0","2024.2.25.232703.dev0","2024.2.28.232744.dev0","2024.2.29.232658.dev0","2024.2.3.232712.dev0","2024.2.4.232659.dev0","2024.2.5.232712.dev0","2024.2.9.232659.dev0","2024.3.10","2024.3.10.232703.dev0","2024.3.14.232657.dev0","2024.3.17.232657.dev0","2024.3.18.232707.dev0","2024.3.19.232701.dev0","2024.3.2.232720.dev0","2024.3.20.232704.dev0","2024.3.22.232703.dev0","2024.3.29.232706.dev0","2024.3.3.232706.dev0","2024.3.30.232704.dev0","2024.3.31.232706.dev0","2024.3.4.232716.dev0","2024.3.6.232659.dev0","2024.3.7.232716.dev0","2024.3.8.232718.dev0","2024.3.9.232714.dev0","2024.4.1.232704.dev0","2024.4.13.232802.dev0","2024.4.18.232703.dev0","2024.4.20.232659.dev0","2024.4.21.232710.dev0","2024.4.28.232723.dev0","2024.4.3.233315.dev0","2024.4.4.232729.dev0","2024.4.6.232655.dev0","2024.4.7.232657.dev0","2024.4.8.232708.dev0","2024.4.9","2024.4.9.232723.dev0","2024.5.10.232705.dev0","2024.5.11.232654.dev0","2024.5.12.232709.dev0","2024.5.13.232704.dev0","2024.5.16.232713.dev0","2024.5.17.232726.dev0","2024.5.18.232655.dev0","2024.5.20.232721.dev0","2024.5.22.232749.dev0","2024.5.23.232707.dev0","2024.5.25.232709.dev0","2024.5.26","2024.5.26.232731.dev0","2024.5.27","2024.5.27.232744.dev0","2024.5.29.232700.dev0","2024.5.30.232720.dev0","2024.5.4.232706.dev0","2024.5.5.232701.dev0","2024.5.8.232715.dev0","2024.6.1.232725.dev0","2024.6.11.232712.dev0","2024.6.13.232720.dev0","2024.6.15.232712.dev0","2024.6.16.232832.dev0","2024.6.17.232743.dev0","2024.6.20.232815.dev0","2024.6.21.232706.dev0","2024.6.22.232706.dev0","2024.6.24.232830.dev0","2024.6.27.232805.dev0","2024.6.29.232730.dev0","2024.6.30.232744.dev0","2024.7.1","2024.7.1.232715.dev0","2024.7.10.232707.dev0","2024.7.11.232833.dev0","2024.7.12.232729.dev0","2024.7.13.232701.dev0","2024.7.14.232743.dev0","2024.7.15.232803.dev0","2024.7.16","2024.7.16.232919.dev0","2024.7.19.25855.dev0","2024.7.2","2024.7.2.232715.dev0","2024.7.23.232906.dev0","2024.7.24.232745.dev0","2024.7.25","2024.7.25.232820.dev0","2024.7.29.232758.dev0","2024.7.3.232825.dev0","2024.7.30.232707.dev0","2024.7.31.232733.dev0","2024.7.5.232716.dev0","2024.7.6.232701.dev0","2024.7.7","2024.7.7.232743.dev0","2024.7.8","2024.7.8.232708.dev0","2024.7.9","2024.7.9.232843.dev0","2024.8.1","2024.8.1.232808.dev0","2024.8.12.232840.dev0","2024.8.13.232739.dev0","2024.8.15.233031.dev0","2024.8.18.232809.dev0","2024.8.19.232821.dev0","2024.8.21.232751.dev0","2024.8.26.232811.dev0","2024.8.4.232814.dev0","2024.8.5.232823.dev0","2024.8.6","2024.8.6.232802.dev0","2024.9.1.235933.dev0","2024.9.13.232912.dev0","2024.9.14.232748.dev0","2024.9.17.232940.dev0","2024.9.2.232855.dev0","2024.9.24.232842.dev0","2024.9.25.232842.dev0","2024.9.26.232938.dev0","2024.9.27","2024.9.27.232842.dev0","2024.9.29.232819.dev0","2024.9.30.232929.dev0","2024.9.5.232840.dev0","2024.9.7.232731.dev0","2024.9.8.232909.dev0","2025.1.11.232806.dev0","2025.1.12","2025.1.12.232754.dev0","2025.1.15","2025.1.15.232837.dev0","2025.1.16.232854.dev0","2025.1.19.232735.dev0","2025.1.20.232744.dev0","2025.1.21.232800.dev0","2025.1.23.232810.dev0","2025.1.26","2025.1.26.34637.dev0","2025.1.28.232803.dev0","2025.1.29.232818.dev0","2025.1.30.232843.dev0","2025.10.1.232815.dev0","2025.10.11.232807.dev0","2025.10.12.232804.dev0","2025.10.14","2025.10.14.232845.dev0","2025.10.15.232824.dev0","2025.10.18.232824.dev0","2025.10.22","2025.10.22.193525.dev0","2025.10.22.232844.dev0","2025.10.24.232923.dev0","2025.10.25.232842.dev0","2025.10.27.232853.dev0","2025.10.28.232931.dev0","2025.10.31.222828.dev0","2025.11.1.232827.dev0","2025.11.1.73148.dev0","2025.11.11.5312.dev0","2025.11.12","2025.11.12.5349.dev0","2025.11.14.235840.dev0","2025.11.15.232912.dev0","2025.11.16.232923.dev0","2025.11.18.232918.dev0","2025.11.19.232938.dev0","2025.11.20.232939.dev0","2025.11.21.232936.dev0","2025.11.23.233008.dev0","2025.11.23.5251.dev0","2025.11.24.232953.dev0","2025.11.28.232930.dev0","2025.11.29.232949.dev0","2025.11.3.233024.dev0","2025.11.5.232946.dev0","2025.11.7.232914.dev0","2025.11.8.232845.dev0","2025.11.9.232846.dev0","2025.12.1.10606.dev0","2025.12.1.233105.dev0","2025.12.1.51642.dev0","2025.12.12.233036.dev0","2025.12.13.232949.dev0","2025.12.15.233113.dev0","2025.12.18.235942.dev0","2025.12.19.233017.dev0","2025.12.20.232942.dev0","2025.12.24.233043.dev0","2025.12.25.233051.dev0","2025.12.26.233056.dev0","2025.12.29.233040.dev0","2025.12.3.233056.dev0","2025.12.30.233018.dev0","2025.12.31.233056.dev0","2025.12.4.233042.dev0","2025.12.5.232956.dev0","2025.12.6.232939.dev0","2025.12.8","2025.12.8.550.dev0","2025.12.9.233030.dev0","2025.2.10.232934.dev0","2025.2.11.232920.dev0","2025.2.19","2025.2.19.23542.dev0","2025.2.20.232914.dev0","2025.2.21.232913.dev0","2025.2.22.232738.dev0","2025.2.23.232748.dev0","2025.2.26.232946.dev0","2025.2.28.232826.dev0","2025.2.8.232844.dev0","2025.2.9.232824.dev0","2025.3.13.232844.dev0","2025.3.15.232805.dev0","2025.3.16.232921.dev0","2025.3.2.232817.dev0","2025.3.21","2025.3.21.232842.dev0","2025.3.22.232834.dev0","2025.3.23.232844.dev0","2025.3.25","2025.3.25.703.dev0","2025.3.26","2025.3.26.420.dev0","2025.3.27","2025.3.27.233514.dev0","2025.3.28.232920.dev0","2025.3.3.232847.dev0","2025.3.30.232927.dev0","2025.3.31","2025.3.31.214356.dev0","2025.3.4.232844.dev0","2025.3.5.232947.dev0","2025.3.7.232704.dev0","2025.4.18.232954.dev0","2025.4.19.232942.dev0","2025.4.23.1659.dev0","2025.4.23.232926.dev0","2025.4.24.232927.dev0","2025.4.25.232910.dev0","2025.4.26.232923.dev0","2025.4.27.233024.dev0","2025.4.28.232934.dev0","2025.4.29.232920.dev0","2025.4.30","2025.4.30.232944.dev0","2025.4.5.232914.dev0","2025.4.6.232826.dev0","2025.5.10.232848.dev0","2025.5.11.232911.dev0","2025.5.16.232928.dev0","2025.5.17.232915.dev0","2025.5.18.232948.dev0","2025.5.20.232932.dev0","2025.5.21.232935.dev0","2025.5.22","2025.5.22.232956.dev0","2025.5.22.93922.dev0","2025.5.23.233016.dev0","2025.5.26.232937.dev0","2025.5.27.232941.dev0","2025.5.28.232948.dev0","2025.5.3.232917.dev0","2025.5.30.233011.dev0","2025.5.5.232943.dev0","2025.5.6.232932.dev0","2025.6.1.232947.dev0","2025.6.12.233004.dev0","2025.6.25","2025.6.25.235247.dev0","2025.6.26.233029.dev0","2025.6.27.233026.dev0","2025.6.28.234349.dev0","2025.6.29.233002.dev0","2025.6.3.233020.dev0","2025.6.30","2025.6.30.233919.dev0","2025.6.5.233116.dev0","2025.6.6.233002.dev0","2025.6.7.233023.dev0","2025.6.8.232939.dev0","2025.6.9","2025.6.9.234059.dev0","2025.7.1.235725.dev0","2025.7.11.233035.dev0","2025.7.12.233122.dev0","2025.7.13.233101.dev0","2025.7.14.233051.dev0","2025.7.16.233138.dev0","2025.7.18.233100.dev0","2025.7.19.233203.dev0","2025.7.2.233055.dev0","2025.7.21","2025.7.21.234438.dev0","2025.7.22.233113.dev0","2025.7.23.233136.dev0","2025.7.24.233125.dev0","2025.7.25.233059.dev0","2025.7.26.233101.dev0","2025.7.27.233142.dev0","2025.7.29.233301.dev0","2025.7.30.233130.dev0","2025.7.31.233123.dev0","2025.7.5.233013.dev0","2025.7.6.233008.dev0","2025.7.7.233044.dev0","2025.7.8.233037.dev0","2025.7.9.233050.dev0","2025.8.1.233124.dev0","2025.8.11","2025.8.11.34503.dev0","2025.8.12.233030.dev0","2025.8.13.233032.dev0","2025.8.16.232932.dev0","2025.8.18.232943.dev0","2025.8.19.232936.dev0","2025.8.2.233207.dev0","2025.8.20","2025.8.20.232911.dev0","2025.8.20.24358.dev0","2025.8.21.235612.dev0","2025.8.22","2025.8.22.235700.dev0","2025.8.22.31729.dev0","2025.8.23.234735.dev0","2025.8.27","2025.8.27.235607.dev0","2025.8.28.232853.dev0","2025.8.29.232845.dev0","2025.8.3.233131.dev0","2025.8.30.232839.dev0","2025.8.5.233158.dev0","2025.8.6.233141.dev0","2025.8.7.233150.dev0","2025.8.8.233030.dev0","2025.9.10.232823.dev0","2025.9.11.232836.dev0","2025.9.12.232737.dev0","2025.9.13.232728.dev0","2025.9.16.232710.dev0","2025.9.17.232802.dev0","2025.9.19.232813.dev0","2025.9.21.232818.dev0","2025.9.22.232823.dev0","2025.9.23","2025.9.23.232818.dev0","2025.9.23.64003.dev0","2025.9.26","2025.9.26.220624.dev0","2025.9.30.72057.dev0","2025.9.5","2025.9.5.224711.dev0","2025.9.7.232816.dev0","2025.9.7.655.dev0","2025.9.8.232917.dev0","2026.1.1.233103.dev0","2026.1.16.233125.dev0","2026.1.19.233146.dev0","2026.1.19.359.dev0","2026.1.2.233036.dev0","2026.1.25.233128.dev0","2026.1.27.233257.dev0","2026.1.29","2026.1.29.165626.dev0","2026.1.3.233044.dev0","2026.1.30.233459.dev0","2026.1.31","2026.1.31.233334.dev0","2026.1.4.233103.dev0","2026.1.5.233118.dev0","2026.1.6.233142.dev0","2026.2.12.233641.dev0","2026.2.16.233630.dev0","2026.2.17.233631.dev0","2026.2.18.235726.dev0","2026.2.19.233638.dev0","2026.2.20.235452.dev0","2026.2.21","2026.2.21.202150.dev0","2026.2.22.233517.dev0","2026.2.26.233640.dev0","2026.2.3.233612.dev0","2026.2.4","2026.2.4.233607.dev0","2026.2.6.233518.dev0","2026.2.7.233648.dev0","2026.2.9.233747.dev0","2026.3.10.233607.dev0","2026.3.11.233532.dev0","2026.3.13","2026.3.13.83652.dev0","2026.3.17","2026.3.17.232108.dev0","2026.3.2.233544.dev0","2026.3.21.233500.dev0","2026.3.29.233709.dev0","2026.3.3","2026.3.3.162408.dev0","2026.4.10.235301.dev0","2026.4.30.234007.dev0","2026.4.4.233651.dev0","2026.4.5.233732.dev0","2026.4.7.233742.dev0","2026.5.16.233954.dev0","2026.5.24.234402.dev0","2026.5.25.234532.dev0","2026.5.3.233852.dev0","2026.5.5.233942.dev0","2026.6.10.235405.dev0","2026.6.11.235628.dev0","2026.6.12.235626.dev0","2026.6.13.234541.dev0","2026.6.16.106.dev0","2026.6.16.235352.dev0","2026.6.17.235412.dev0","2026.6.18.235958.dev0","2026.6.20.234736.dev0","2026.6.21.235142.dev0","2026.6.24.234707.dev0","2026.6.26.234622.dev0","2026.6.27.234340.dev0","2026.6.28.234618.dev0","2026.6.29.234344.dev0","2026.6.30.234726.dev0","2026.6.6.234447.dev0","2026.6.9","2026.6.9.230517.dev0","2026.7.1.235203.dev0","2026.7.2.234458.dev0","2026.7.3.234421.dev0"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/yt-dlp/PYSEC-2026-3622.yaml"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}