{"action":"Upgrade yt-dlp to 2026.7.4 or later.","affected":[{"fixed":"2026.7.4","introduced":"0"}],"component":"yt-dlp","cve_ids":["CVE-2026-55404"],"ecosystem":"PyPI","epss":0.0064,"exploited":false,"fixed_versions":["2026.7.4"],"ghsa_id":"GHSA-6v4j-43gg-vj32","id":"tcs_01M5KH6DBP6H567VERX17ZA0TC","modified_at":"2026-08-04T14:30:31.383749939Z","published_at":"2026-08-04T11:34:43.163955Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3622","https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-6v4j-43gg-vj32","https://nvd.nist.gov/vuln/detail/CVE-2026-55404","https://github.com/yt-dlp/yt-dlp/commit/6fc85f617a5850307fd5b258477070e6ee177796","https://github.com/yt-dlp/yt-dlp/commit/b6590aaa1e3808155d69c9a79a797ae484163789","https://github.com/yt-dlp/yt-dlp","https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2026.07.04.221833","https://github.com/yt-dlp/yt-dlp/releases/tag/2026.07.04","https://pypi.org/project/yt-dlp","https://github.com/advisories/GHSA-6v4j-43gg-vj32"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-3622","url":"https://osv.dev/vulnerability/PYSEC-2026-3622"}],"summary":"yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output"}