The officially official Devuan Forum!

tux_99

Member

Registered: 2025-06-17

Posts: 138  

yt-dlp in Debian 13 / Devuan 6 affected by serious CVE (Score: High)

Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.

https://nvd.nist.gov/vuln/detail/CVE-2026-55404

Debian 13/Devuan 6 still has an old version from 2025 in the main stable repo and 2026.03.17 in backports, so a month after the publication of the CVE there is still no sign in the repos of the 2026.7.4 version that fixes this bug.

Being new to the Debian/Devuan world I'm a bit concerned about this apparent lackadaisical attitude by some Debian packagers in the face of a serious vulnerability. Other distros such as Arch have provided the fixed version within 24 hours of the upstream release.

Edit:
I see Debian has 2026.7.4 packaged up in forky and sid, what are they waiting for to release it also as a security update for trixie?
https://packages.debian.org/sid/yt-dlp

Last edited by tux_99 (Today 19:25:19)

---

“Either the users control the program – or the program controls the users” Richard Stallman

brocashelm

Member

Registered: 2020-06-29

Posts: 254  

Website

Re: yt-dlp in Debian 13 / Devuan 6 affected by serious CVE (Score: High)

You could just use the upstream binary (alternatively, use this binary if your Python version is too old or plain C is more appealing to you).

Download that, move it to your /usr/local/bin, and then run chmod 744 on it so that it can be executed and run as a non-root user. Simply typing yt-dlp will point to that upstream binary you downloaded (by default), and when you want to check for updates, just run sudo yt-dlp -U.

---

Devuan Users Forum

tux_99

Member

Registered: 2025-06-17

Posts: 138  

Re: yt-dlp in Debian 13 / Devuan 6 affected by serious CVE (Score: High)

Yes I won't use the package anymore and I will instead install the upstream binary, but my concern is more in general, if this is the attitude towards serious CVEs of Debian then maybe I chose the wrong distro (of course it's not Devuan's fault as Devuan depends on Debian for most of the packages, but by choosing Devuan I made myself dependent on Debian which I'm starting to be concerned about) because this means I will have to myself keep track of CVEs for all the packages I installed, as apparently I can't rely on the Debian packagers for that.

I only came across this CVE by accident, if I hadn't I would have still continued to use the vulnerable version until Debian eventually decides to make the fix available for trixie.

Last edited by tux_99 (Today 19:46:09)

---

“Either the users control the program – or the program controls the users” Richard Stallman

Calamity

Member

Registered: 2021-10-23

Posts: 92  

Website

Re: yt-dlp in Debian 13 / Devuan 6 affected by serious CVE (Score: High)

You can also use ~/.local/bin to store (or symlink) portable executables if you want to avoid involving root entirely. I think it's in $PATH by default in Devuan, meaning any executable in this folder can be quickly accessed via terminal. However stuff like lightdm can change this, so to be sure you can edit ~/.bashrc - just append this line:

export PATH="$HOME/.local/bin:$PATH"

---

Re-examine all that you have been told. Dismiss that which insults your soul.  - Walt Whitman
Dump shampoo and hair dye
Global Skywatch・Subliminal Manipulation