mpv-player/mpv vulnerabilities

Latest mpv-player/mpv CVEs

Newest publication first

1. CVE-2026-123095 mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines

   Published 2026-11-05

   High·CVSS 7.7 EPSS 0.49%

   mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass url_is_safe() to open file:// or av:/...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.