Playlist Injection Vulnerability in mpv Media Player by mpv Player
CVE-2026-123095

7.7HIGH

Key Information:

Vendor

Mpv-player

Status
Mpv
Vendor
CVE Published:
5 November 2026

What is CVE-2026-123095?

The mpv Media Player version 0.29.0 before 0.42.0 is affected by a playlist injection vulnerability allowing remote attackers to manipulate playlist URLs. By exploiting the bundled ytdl_hook script, attackers can embed arbitrary newlines, leading to unchecked entries in playlists. This flaw enables attackers to leverage the bypass of url_is_safe(), potentially executing code by reading local files or loading shared objects through ladspa. Users are advised to upgrade to version 0.42.0 or later to mitigate this risk.

Affected Version(s)

mpv 0.29.0 < 0.42.0

References

https://github.com/mpv-player/mpv/pull/18762
issue-trackingpatch
https://github.com/mpv-player/mpv/commit/c3096515dcd26c14...
patch
https://github.com/mpv-player/mpv/blob/v0.41.0/player/lua...
technical-description

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dilanka Kaushal Hewage (r3vpwnx)
Kacper Michajłow (kasper93)
.