CVE-2026-123095: mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines
mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdlhook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass urlissafe() to open file:// or av:// inputs, reading local files or loading shared objects via ladspa for code execution.
Event History
Frequently Asked Questions
Which installations are affected?
mpv versions from 0.29.0 up to, but not including, 0.42.0 are affected. Version 0.42.0 is not listed as affected.
What must an attacker control to exploit this issue?
The attacker needs control of a feed or page that supplies playlist URLs. They can embed newlines in those URLs to add unchecked playlist entries.
Is authentication required for exploitation?
No authentication is required according to the CVSS vector. The vector indicates that user interaction is required.
What could exploitation allow?
An attacker may bypass url_is_safe() and cause file:// or av:// inputs to be opened. This can enable reading local files or loading shared objects through ladspa for code execution.