CVE-2026-123095

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123095", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-05T12:22:13.130Z", "datePublished": "2026-11-05T15:11:49.933Z", "dateUpdated": "2026-11-09T17:12:29.815Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T15:11:49.933Z"}, "datePublic": "2026-11-04T00:00:00.000Z", "title": "mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines", "descriptions": [{"lang": "en", "value": "mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass url_is_safe() to open file:// or av:// inputs, reading local files or loading shared objects via ladspa for code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of CRLF Sequences ('CRLF Injection')", "cweId": "CWE-93", "type": "CWE"}]}], "affected": [{"vendor": "mpv-player", "product": "mpv", "defaultStatus": "unaffected", "versions": [{"version": "0.29.0", "lessThan": "0.42.0", "status": "affected", "versionType": "semver"}], "packageURL": "pkg:github/mpv-player/mpv", "repo": "https://github.com/mpv-player/mpv"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:mpv:mpv:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.29.0", "versionEndExcluding": "0.42.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/mpv-player/mpv/pull/18762", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/mpv-player/mpv/commit/c3096515dcd26c14004f985538b5aa41db613856", "tags": ["patch"]}, {"url": "https://github.com/mpv-player/mpv/blob/v0.41.0/player/lua/ytdl_hook.lua#L244-L251", "tags": ["technical-description"]}, {"url": "https://github.com/mpv-player/mpv/blob/v0.41.0/player/lua/ytdl_hook.lua#L1115-L1137", "tags": ["technical-description"]}, {"url": "https://github.com/mpv-player/mpv/releases/tag/v0.42.0", "tags": ["release-notes"], "name": "mpv v0.42.0 Release Notes"}, {"url": "https://github.com/mpv-player/mpv", "tags": ["product"]}, {"name": "VulnCheck Advisory: mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/mpv-0.29.0-before-0.42.0-playlist-entry-injection-via-ytdl-hook-newlines"}], "credits": [{"lang": "en", "value": "Dilanka Kaushal Hewage (r3vpwnx)", "type": "finder"}, {"lang": "en", "value": "Kacper Michaj\u0142ow (kasper93)", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T17:12:03.515500Z", "id": "CVE-2026-123095", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T17:12:29.815Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-123095", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-09T17:12:03.515500Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T17:12:16.174Z"}}], "cna": {"title": "mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines", "credits": [{"lang": "en", "type": "finder", "value": "Dilanka Kaushal Hewage (r3vpwnx)"}, {"lang": "en", "type": "remediation developer", "value": "Kacper Michaj\u0142ow (kasper93)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://github.com/mpv-player/mpv", "vendor": "mpv-player", "product": "mpv", "versions": [{"status": "affected", "version": "0.29.0", "lessThan": "0.42.0", "versionType": "semver"}], "packageURL": "pkg:github/mpv-player/mpv", "defaultStatus": "unaffected"}], "datePublic": "2026-11-04T00:00:00.000Z", "references": [{"url": "https://github.com/mpv-player/mpv/pull/18762", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/mpv-player/mpv/commit/c3096515dcd26c14004f985538b5aa41db613856", "tags": ["patch"]}, {"url": "https://github.com/mpv-player/mpv/blob/v0.41.0/player/lua/ytdl_hook.lua#L244-L251", "tags": ["technical-description"]}, {"url": "https://github.com/mpv-player/mpv/blob/v0.41.0/player/lua/ytdl_hook.lua#L1115-L1137", "tags": ["technical-description"]}, {"url": "https://github.com/mpv-player/mpv/releases/tag/v0.42.0", "name": "mpv v0.42.0 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/mpv-player/mpv", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/mpv-0.29.0-before-0.42.0-playlist-entry-injection-via-ytdl-hook-newlines", "name": "VulnCheck Advisory: mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass url_is_safe() to open file:// or av:// inputs, reading local files or loading shared objects via ladspa for code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-93", "description": "Improper Neutralization of CRLF Sequences ('CRLF Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mpv:mpv:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "0.42.0", "versionStartIncluding": "0.29.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T15:11:49.933Z"}}}, "cveMetadata": {"cveId": "CVE-2026-123095", "state": "PUBLISHED", "dateUpdated": "2026-11-09T17:12:29.815Z", "dateReserved": "2026-11-05T12:22:13.130Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-05T15:11:49.933Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/mpv-player/mpv", "product": "mpv", "repo": "https://github.com/mpv-player/mpv", "vendor": "mpv-player", "versions": [{"lessThan": "0.42.0", "status": "affected", "version": "0.29.0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass url_is_safe() to open file:// or av:// inputs, reading local files or loading shared objects via ladspa for code execution."}], "id": "CVE-2026-123095", "lastModified": "2026-11-12T20:57:59.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-123095", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T17:12:03.515500Z", "version": "2.0.3"}}]}, "published": "2026-11-05T16:17:46.580", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/mpv-player/mpv"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/mpv-player/mpv/blob/v0.41.0/player/lua/ytdl_hook.lua#L1115-L1137"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/mpv-player/mpv/blob/v0.41.0/player/lua/ytdl_hook.lua#L244-L251"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/mpv-player/mpv/commit/c3096515dcd26c14004f985538b5aa41db613856"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/mpv-player/mpv/pull/18762"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/mpv-player/mpv/releases/tag/v0.42.0"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/mpv-0.29.0-before-0.42.0-playlist-entry-injection-via-ytdl-hook-newlines"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-93"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "mpv: mpv: Arbitrary code execution via newline injection in playlist URLs", "id": "2567532", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567532"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-93", "details": ["A flaw was found in mpv. A remote attacker who controls a media feed or webpage can exploit this vulnerability by injecting newline characters into playlist URLs processed by the bundled ytdl_hook script. This allows the attacker to bypass URL safety checks and load arbitrary local files or shared libraries, leading to arbitrary code execution or unauthorized data access."], "mitigation": {"lang": "en:us", "value": "Disable the youtube-dl hook script in mpv configuration:\nTo disable the script globally across the system, add the following configuration directive to `/etc/mpv/mpv.conf`:\n```\nytdl=no\n```\nAlternatively, configure the setting per user in `~/.config/mpv/mpv.conf`:\n```\nytdl=no\n```\nFor individual command-line invocations, launch mpv with the `--no-ytdl` flag:\n```\nmpv --no-ytdl <url_or_file>\n```\nIn addition, avoid opening untrusted playlist files, media feeds, or streaming links from unverified sources.\nCaveats:\nDisabling the youtube-dl hook prevents mpv from parsing and playing media directly from external video platforms that rely on youtube-dl or yt-dlp. Any currently running mpv playback sessions must be stopped and restarted for configuration file changes to take effect."}, "name": "CVE-2026-123095", "public_date": "2026-11-05T15:11:49Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123095\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123095\nhttps://github.com/mpv-player/mpv\nhttps://github.com/mpv-player/mpv/blob/v0.41.0/player/lua/ytdl_hook.lua#L1115-L1137\nhttps://github.com/mpv-player/mpv/blob/v0.41.0/player/lua/ytdl_hook.lua#L244-L251\nhttps://github.com/mpv-player/mpv/commit/c3096515dcd26c14004f985538b5aa41db613856\nhttps://github.com/mpv-player/mpv/pull/18762\nhttps://github.com/mpv-player/mpv/releases/tag/v0.42.0\nhttps://www.vulncheck.com/advisories/mpv-0.29.0-before-0.42.0-playlist-entry-injection-via-ytdl-hook-newlines"], "statement": "This vulnerability is rated as an Important impact because successful exploitation permits remote unauthenticated attackers to execute arbitrary code or expose sensitive local files, which warrants an elevated severity over Moderate while remaining below Critical due to requiring user interaction to open an untrusted media feed. In Red Hat enterprise deployments, the mpv media player is not distributed as part of core operating system installations, significantly reducing overall environmental exposure. Where the utility is deployed in workstation or desktop environments, the potential blast radius is limited to the privileges and system access rights of the user running the media playback process.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.29.0,0.42.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "mpv", "source": "cna", "vendor": "mpv-player"}, "product": "mpv", "vendor": "mpv"}], "created": "2026-11-05T16:45:06.274885+00:00", "updated": "2026-11-05T18:00:20.452759+00:00", "vendors": ["mpv", "mpv$PRODUCT$mpv"]}