CVE-2026-123095
mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook…
- Risk score
- 50/100
- CVSS
- 7.5 v3.1
- Published
- 5 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass url_is_safe() to open file:// or av:// inputs, reading local files or loadin…
- Affected
- See advisory
- Fix
- Upgrade the product to 0.42.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
- https://github.com/mpv-player/mpv
- https://github.com/mpv-player/mpv/blob/v0.41.0/player/lua/ytdl_hook.lua#L1115-L1137
- https://github.com/mpv-player/mpv/blob/v0.41.0/player/lua/ytdl_hook.lua#L244-L251
- https://github.com/mpv-player/mpv/commit/c3096515dcd26c14004f985538b5aa41db613856
- https://github.com/mpv-player/mpv/pull/18762
- https://github.com/mpv-player/mpv/releases/tag/v0.42.0
- https://www.vulncheck.com/advisories/mpv-0.29.0-before-0.42.0-playlist-entry-injection-via-ytdl-hook-newlines
Original description
mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass url_is_safe() to open file:// or av:// inputs, reading local files or loading shared objects via ladspa for code execution.
Last activity 5 Nov 2026. Patch Forecast updates every hour.