{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mpv--0.29.0--0.42.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mpv-player:mpv:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-123095"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["mpv (\u003e= 0.29.0, \u003c 0.42.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["mpv-player"],"content_html":"\u003cp\u003eThe mpv media player (versions 0.29.0 through 0.41.0) is affected by a playlist injection vulnerability in the bundled \u003ccode\u003eytdl_hook\u003c/code\u003e script. An attacker can embed newline characters into playlist URLs, causing the script to process unchecked entries. By bypassing the \u003ccode\u003eurl_is_safe()\u003c/code\u003e function, an attacker can coerce the player into opening malicious \u003ccode\u003efile://\u003c/code\u003e or \u003ccode\u003eav://\u003c/code\u003e inputs. This can lead to unauthorized local file reading or remote code execution by forcing the player to load malicious shared objects (e.g., via ladspa).\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may allow attackers to read arbitrary files from the filesystem of the user running mpv, or achieve remote code execution if the application is configured to load external libraries or malicious plugins.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to mpv version 0.42.0 or later immediately to include the patched \u003ccode\u003eytdl_hook\u003c/code\u003e script.\u003c/li\u003e\n\u003cli\u003eAudit environments for instances of mpv currently running versions 0.29.0 to 0.41.0.\u003c/li\u003e\n\u003cli\u003eIn restrictive environments, consider disabling the use of the \u003ccode\u003eytdl_hook\u003c/code\u003e script if it is not required for media playback operations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T18:22:33Z","date_published":"2026-11-05T18:22:33Z","id":"https://feed.craftedsignal.io/briefs/2026-11-mpv-ytdl-injection/","summary":"The mpv media player contains a playlist injection vulnerability in its bundled ytdl_hook script that allows attackers to bypass security checks and execute arbitrary local files or code.","title":"mpv: Playlist injection vulnerability in ytdl_hook (CVE-2026-123095)","url":"https://feed.craftedsignal.io/briefs/2026-11-mpv-ytdl-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Mpv (\u003e= 0.29.0, \u003c 0.42.0)","version":"https://jsonfeed.org/version/1.1"}