Mpv-Player - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/mpv-player/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 18:22:33 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgmpv: Playlist injection vulnerability in ytdl_hook (CVE-2026-123095)https://feed.craftedsignal.io/briefs/2026-11-mpv-ytdl-injection/Thu, 05 Nov 2026 18:22:33 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-mpv-ytdl-injection/The mpv media player contains a playlist injection vulnerability in its bundled ytdl_hook script that allows attackers to bypass security checks and execute arbitrary local files or code.The mpv media player (versions 0.29.0 through 0.41.0) is affected by a playlist injection vulnerability in the bundled ytdl_hook script. An attacker can embed newline characters into playlist URLs, causing the script to process unchecked entries. By bypassing the url_is_safe() function, an attacker can coerce the player into opening malicious file:// or av:// inputs. This can lead to unauthorized local file reading or remote code execution by forcing the player to load malicious shared objects (e.g., via ladspa).

Impact

Successful exploitation may allow attackers to read arbitrary files from the filesystem of the user running mpv, or achieve remote code execution if the application is configured to load external libraries or malicious plugins.

Recommendation

  • Upgrade to mpv version 0.42.0 or later immediately to include the patched ytdl_hook script.
  • Audit environments for instances of mpv currently running versions 0.29.0 to 0.41.0.
  • In restrictive environments, consider disabling the use of the ytdl_hook script if it is not required for media playback operations.
]]>highadvisory