mpv: Playlist injection vulnerability in ytdl_hook (CVE-2026-123095)

The mpv media player (versions 0.29.0 through 0.41.0) is affected by a playlist injection vulnerability in the bundled ytdl_hook script. An attacker can embed newline characters into playlist URLs, causing the script to process unchecked entries. By bypassing the url_is_safe() function, an attacker can coerce the player into opening malicious file:// or av:// inputs. This can lead to unauthorized local file reading or remote code execution by forcing the player to load malicious shared objects (e.g., via ladspa).

Impact

Successful exploitation may allow attackers to read arbitrary files from the filesystem of the user running mpv, or achieve remote code execution if the application is configured to load external libraries or malicious plugins.

Recommendation

• Upgrade to mpv version 0.42.0 or later immediately to include the patched ytdl_hook script.
• Audit environments for instances of mpv currently running versions 0.29.0 to 0.41.0.
• In restrictive environments, consider disabling the use of the ytdl_hook script if it is not required for media playback operations.