yt-dlp in Debian 13 / Devuan 6 affected by serious CVE (Score: High)

tux_99 · Yesterday 19:13:22

Prior to 2026.7.4, the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files using attacker-controlled webpage_url or filename metadata without sufficient validation or escaping, allowing malicious file:// URI injection on Windows or newline-based desktop entry key injection on Linux that can execute commands if the generated shortcut is opened. This issue is fixed in version 2026.7.4.

https://nvd.nist.gov/vuln/detail/CVE-2026-55404

Debian 13/Devuan 6 still has an old version from 2025 in the main stable repo and 2026.03.17 in backports, so a month after the publication of the CVE there is still no sign in the repos of the 2026.7.4 version that fixes this bug.

Being new to the Debian/Devuan world I'm a bit concerned about this apparent lackadaisical attitude by some Debian packagers in the face of a serious vulnerability. Other distros such as Arch have provided the fixed version within 24 hours of the upstream release.

Edit:
I see Debian has 2026.7.4 packaged up in forky and sid, what are they waiting for to release it also as a security update for trixie?
https://packages.debian.org/sid/yt-dlp

Last edited by tux_99 (Yesterday 19:25:19)

brocashelm · Yesterday 19:26:22

You could just use the upstream binary (alternatively, use this binary if your Python version is too old or plain C is more appealing to you).

Download that, move it to your /usr/local/bin, and then run chmod 744 on it so that it can be executed and run as a non-root user. Simply typing yt-dlp will point to that upstream binary you downloaded (by default), and when you want to check for updates, just run sudo yt-dlp -U.

tux_99 · Yesterday 19:41:44

Yes I won't use the package anymore and I will instead install the upstream binary, but my concern is more in general, if this is the attitude towards serious CVEs of Debian then maybe I chose the wrong distro (of course it's not Devuan's fault as Devuan depends on Debian for most of the packages, but by choosing Devuan I made myself dependent on Debian which I'm starting to be concerned about) because this means I will have to myself keep track of CVEs for all the packages I installed, as apparently I can't rely on the Debian packagers for that.

I only came across this CVE by accident, if I hadn't I would have still continued to use the vulnerable version until Debian eventually decides to make the fix available for trixie.

Last edited by tux_99 (Yesterday 19:46:09)

Calamity · Yesterday 20:30:51

You can also use ~/.local/bin to store (or symlink) portable executables if you want to avoid involving root entirely. I think it's in $PATH by default in Devuan, meaning any executable in this folder can be quickly accessed via terminal. However stuff like lightdm can change this, so to be sure you can edit ~/.bashrc - just append this line:

export PATH="$HOME/.local/bin:$PATH"

fsmithred · Yesterday 21:49:52

Installing yt-dlp from the repo is pointless since every version stops working after a short time due to youtube's efforts to stop yt-dlp from working. That's probably why the maintainer doesn't bother to update it.

This page has some helpful information -
https://vidkraken.com/blog/yt-dlp-403-forbidden

tux_99 · Yesterday 22:28:44

Well the packaged version from backports (2026.03.17) was working fine for me until a couple of days ago (BTW, yt-dlp isn't only for youtube, it works on many sites), only today it started acting up which is why I was looking for updates and found out about the CVE.

fsmithred wrote:

That's probably why the maintainer doesn't bother to update it.

A serious CVE should be a good enough reason to update it.

Last edited by tux_99 (Yesterday 22:31:27)

brocashelm · Today 02:34:45

You should also look into FreeTube, which can also work with it if you want to download or stream videos you come across externally.

blackhole · Today 07:18:17

With the number of vulnerabilities found in this over the last three years, it may be better to direct your concerns to the upstream project itself rather than Debian.

https://www.cvedetails.com/vulnerabilit … oject.html

Currently, the backports version is the same as the version in unstable, so the solution seems to be to install the bacports version and follow that. I thought it was commonly known that, with few exceptions, Debian "freezes" packages at a specific version and any security patches are backported as necessary. So any newer version will never be available in stable. As it stands, there is no DSA for this as yet. You would have to search the mailing lists / ask the maintainer.

tux_99 · Today 13:10:03

blackhole wrote:

Currently, the backports version is the same as the version in unstable, so the solution seems to be to install the bacports version and follow that.

As I said I was already using the version from excalibur backports but that's 2026.03.17, which is not the latest version and it's not the same as unstable which has the latest version (2026.07.04-1), so your statement is simply incorrect.

it may be better to direct your concerns to the upstream project

What nonsense comment, my concern is that debian has a known vulnerable version since more than a month in stable with no security update available, upstream has nothing to do with that.

Debian "freezes" packages at a specific version and any security patches are backported as necessary. So any newer version will never be available in stable.

I don't care whether Debian backports the security patch or the latest version as long as the CVE is fixed, but so far they haven't done either of the two options.

Last edited by tux_99 (Today 13:12:52)

blackhole · Today 13:54:20

Not sure where all the hostility is coming from?

My source of the version info is here: https://tracker.debian.org/pkg/yt-dlp

But there are inconsistencies between the source and binary package versions for stable backports:

https://packages.debian.org/source/trix … rts/yt-dlp
https://packages.debian.org/trixie-backports/yt-dlp

The source is ahead of the binary, which may mean the update is in the works... so yes you're correct that it's still behind for now.

All we know about this particular CVE is that there is no DSA against it and thus no patch. For some reason Debian security aren't in a hurry to fix it.

This isn't the Debian official forum or mailing lists though, so maybe take it up with them using one of those channels? Mailing list is preferred - perhaps search the list first.

Last edited by blackhole (Today 14:09:45)

Dutch_Master · Today 15:44:10

FYI: latest version, as of date of writing this, was released yesterday.

rbit · Today 16:45:34

I would also point out, according to what you wrote,

tux_99 wrote:

the --write-link, --write-url-link, and --write-desktop-link options can write .url or .desktop shortcut files ...

If you don't use those options (--write-link, --write-url-link, or --write-desktop-link), this particular issue won't affect you. If you do use them, and don't want to check the output files, then by all means, update to a newer version (which is probably necessary anyway for it to work with youtube)

RedGreen925 · Today 16:49:37

FYI: latest version, as of date of writing this, was released yesterday.

Yes and for anyone supposedly concerned with their security in using it, it is a less than five minute process to upgrade to the latest version like I did last night after seeing this thread. But those that would rather bitch and complain about how hard done by they are by the very busy Debian maintainer not doing it, that is too much of a burden on them. And to top it off the complaint is made in a place that that maintainer is likely never to see.

zeus@9600k:~$ which yt-dlp
/usr/bin/yt-dlp
zeus@9600k:~$ chmod +x /home/zeus/Downloads/yt-dlp_linux
zeus@9600k:~$ mv /home/zeus/Downloads/yt-dlp_linux /home/zeus/bin/yt-dlp
zeus@9600k:~$ which yt-dlp
/home/zeus/bin/yt-dlp
zeus@9600k:~$ yt-dlp -v
[debug] Command-line config: ['-v']
[debug] System config "/etc/yt-dlp.conf": []
[debug] Encodings: locale UTF-8, fs utf-8, pref UTF-8, out utf-8, error utf-8, screen utf-8
[debug] yt-dlp version stable@2026.08.19 from yt-dlp/yt-dlp (linux_exe)
[debug] Python 3.14.7 (CPython x86_64 64bit) - Linux-6.12.101+deb13-amd64-x86_64-with-glibc2.41 (OpenSSL 3.5.7 9 Jun 2026, glibc 2.41)
[debug] exe versions: ffmpeg 7.1.5-0 (setts), ffprobe 7.1.5-0
[debug] Optional libraries: Cryptodome-3.23.0, brotli-1.2.0, certifi-2026.07.22, curl_cffi-0.16.0, mutagen-1.48.1, requests-2.34.2, secretstorage-3.5.0, sqlite3-3.53.4, urllib3-2.7.0, websockets-17.0.1, yt_dlp_ejs-0.8.0
[debug] JS runtimes: none
[debug] Proxy map: {}
[debug] Request Handlers: urllib, requests, websockets, curl_cffi
[debug] Plugin directories: none
[debug] Loaded 1744 extractors

tux_99 · Today 19:10:25

blackhole wrote:

Not sure where all the hostility is coming from?

I wouldn't call it hostility, but if you write a reply that clearly shows that you didn't read the previous posts in the thread and therefore write incorrect or redundant stuff then don't expect to be also thanked for that.

This isn't the Debian official forum or mailing lists though, so maybe take it up with them using one of those channels? Mailing list is preferred - perhaps search the list first.

I'm a Devuan user and this affects Devuan too so I'm writing it here, I have no interest in joining the Debian forum or ML. Also as I suspected there must be Debian Devs keeping an eye on this forum too, as it's too much of a coincidence that they started working on the yt-dlp package for trixie last night a few hours after I started this thread here.

Dutch_Master wrote:

FYI: latest version, as of date of writing this, was released yesterday.

Yep, the latest upstream version, I'm using that right now since I'm no longer using the outdated and insecure packaged Debian version.

rbit wrote:

If you don't use those options (--write-link, --write-url-link, or --write-desktop-link), this particular issue won't affect you.

RedGreen925 wrote:

But those that would rather bitch and complain about how hard done by they are by the very busy Debian maintainer not doing it, that is too much of a burden on them.

This is not about me, as I already wrote I have now moved on to the upstream binaries anyway, it's about all other Debian 13 / Devuan 6 users who use the Debian yt-dlp package and might not even be aware of this CVE.

But if we have to manually install binaries from upstream to avoid security issues then what's the point of a distro?

My main concern now is how many other long known CVEs are there in other Debian packages that have not been fixed yet?

Do I really have to start checking all the packages that I use for known CVEs that Debian hasn't fixed yet?

Does this not make you concerned?

Last edited by tux_99 (Today 19:15:34)

stargate-sg1-cheyenne-mtn · Today 20:14:28

yt-dlp definitely has a learning curve no matter how you install and set it up.

there is a reason why the main webpage is a very very long slog:

https://github.com/yt-dlp/yt-dlp

Altoid · Today 20:28:58

Hello:

tux_99 wrote:

... how many other long known CVEs are there in other Debian packages that have not been fixed yet?

Cannot but agree that you do have a point.

That said, I have not noticed that CVEs get slept on.
From memory (make what you will of that), the CVEs I have read about have usually been solved/worked out in three or four days.

This from using Devuan since ~2017.

Best,

A.

The officially official Devuan Forum!

#1 Yesterday 19:13:22

yt-dlp in Debian 13 / Devuan 6 affected by serious CVE (Score: High)

#2 Yesterday 19:26:22

Re: yt-dlp in Debian 13 / Devuan 6 affected by serious CVE (Score: High)

#3 Yesterday 19:41:44

Re: yt-dlp in Debian 13 / Devuan 6 affected by serious CVE (Score: High)

#4 Yesterday 20:30:51

Re: yt-dlp in Debian 13 / Devuan 6 affected by serious CVE (Score: High)

#5 Yesterday 21:49:52

Re: yt-dlp in Debian 13 / Devuan 6 affected by serious CVE (Score: High)

#6 Yesterday 22:28:44

Re: yt-dlp in Debian 13 / Devuan 6 affected by serious CVE (Score: High)

#7 Today 02:34:45

Re: yt-dlp in Debian 13 / Devuan 6 affected by serious CVE (Score: High)

#8 Today 07:18:17

Re: yt-dlp in Debian 13 / Devuan 6 affected by serious CVE (Score: High)

#9 Today 13:10:03

Re: yt-dlp in Debian 13 / Devuan 6 affected by serious CVE (Score: High)

#10 Today 13:54:20

Re: yt-dlp in Debian 13 / Devuan 6 affected by serious CVE (Score: High)

#11 Today 15:44:10

Re: yt-dlp in Debian 13 / Devuan 6 affected by serious CVE (Score: High)

#12 Today 16:45:34

Re: yt-dlp in Debian 13 / Devuan 6 affected by serious CVE (Score: High)

#13 Today 16:49:37

Re: yt-dlp in Debian 13 / Devuan 6 affected by serious CVE (Score: High)

#14 Today 19:10:25

Re: yt-dlp in Debian 13 / Devuan 6 affected by serious CVE (Score: High)

#15 Today 20:14:28

Re: yt-dlp in Debian 13 / Devuan 6 affected by serious CVE (Score: High)

#16 Today 20:28:58

Re: yt-dlp in Debian 13 / Devuan 6 affected by serious CVE (Score: High)

Board footer