CVE-2026-123095: falha de alta gravidade em mpv-player mpv
mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.7epss 0.5%
mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass url_is_safe() to open file:// or av:// inputs, reading local files or loading shared objects via ladspa for code execution.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
mpv-player · mpvReferências
https://github.com/mpv-player/mpvhttps://github.com/mpv-player/mpv/blob/v0.41.0/player/lua/ytdl_hook.lua#L1115-L1137https://github.com/mpv-player/mpv/blob/v0.41.0/player/lua/ytdl_hook.lua#L244-L251https://github.com/mpv-player/mpv/commit/c3096515dcd26c14004f985538b5aa41db613856https://github.com/mpv-player/mpv/pull/18762https://github.com/mpv-player/mpv/releases/tag/v0.42.0https://www.vulncheck.com/advisories/mpv-0.29.0-before-0.42.0-playlist-entry-injection-via-ytdl-hook-newlines