Mpv (>= 0.29.0, < 0.42.0)

The mpv media player contains a playlist injection vulnerability in its bundled ytdl_hook script that allows attackers to bypass security checks and execute arbitrary local files or code.