{"id":"UBUNTU-CVE-2026-123095","details":"mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass url_is_safe() to open file:// or av:// inputs, reading local files or loading shared objects via ladspa for code execution.","modified":"2026-11-07T01:46:33.980920923Z","published":"2026-11-06T00:00:00Z","upstream":["CVE-2026-123095"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-123095"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-123095"},{"type":"REPORT","url":"https://github.com/mpv-player/mpv"},{"type":"REPORT","url":"https://github.com/mpv-player/mpv/blob/v0.41.0/player/lua/ytdl_hook.lua#L1115-L1137"},{"type":"REPORT","url":"https://github.com/mpv-player/mpv/blob/v0.41.0/player/lua/ytdl_hook.lua#L244-L251"},{"type":"REPORT","url":"https://github.com/mpv-player/mpv/commit/c3096515dcd26c14004f985538b5aa41db613856"},{"type":"REPORT","url":"https://github.com/mpv-player/mpv/pull/18762"},{"type":"REPORT","url":"https://github.com/mpv-player/mpv/releases/tag/v0.42.0"},{"type":"REPORT","url":"https://www.vulncheck.com/advisories/mpv-0.29.0-before-0.42.0-playlist-entry-injection-via-ytdl-hook-newlines"}],"affected":[{"package":{"name":"mpv","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/mpv?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2-1ubuntu2","0.12.0-1","0.14.0-1","0.14.0-1build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libmpv1","binary_version":"0.14.0-1build1"},{"binary_name":"mpv","binary_version":"0.14.0-1build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-123095.json"}},{"package":{"name":"mpv","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/mpv?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26.0-3ubuntu1","0.26.0-3ubuntu2","0.27.0-2ubuntu2","0.27.0-2ubuntu3","0.27.0-2ubuntu4","0.27.2-1ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"libmpv1","binary_version":"0.27.2-1ubuntu1"},{"binary_name":"mpv","binary_version":"0.27.2-1ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-123095.json"}},{"package":{"name":"mpv","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/mpv?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.29.1-1ubuntu1","0.30.0-1ubuntu1","0.32.0-1ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"libmpv1","binary_version":"0.32.0-1ubuntu1"},{"binary_name":"mpv","binary_version":"0.32.0-1ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-123095.json"}},{"package":{"name":"mpv","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/mpv?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.33.1-1ubuntu1","0.34.0-2ubuntu1","0.34.1-1ubuntu1","0.34.1-1ubuntu2","0.34.1-1ubuntu3"],"ecosystem_specific":{"binaries":[{"binary_name":"libmpv1","binary_version":"0.34.1-1ubuntu3"},{"binary_version":"0.34.1-1ubuntu3","binary_name":"mpv"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-123095.json"}},{"package":{"name":"mpv","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/mpv?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.36.0-1ubuntu1","0.36.0-1ubuntu2","0.37.0-1ubuntu1","0.37.0-1ubuntu2","0.37.0-1ubuntu3","0.37.0-1ubuntu4"],"ecosystem_specific":{"binaries":[{"binary_version":"0.37.0-1ubuntu4","binary_name":"libmpv2"},{"binary_name":"mpv","binary_version":"0.37.0-1ubuntu4"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-123095.json"}},{"package":{"name":"mpv","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/mpv?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.41.0-2ubuntu4","0.41.0-2ubuntu5"],"ecosystem_specific":{"binaries":[{"binary_name":"libmpv2","binary_version":"0.41.0-2ubuntu5"},{"binary_version":"0.41.0-2ubuntu5","binary_name":"mpv"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-123095.json"}},{"package":{"name":"mpv","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/mpv?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.40.0-3ubuntu1","0.40.0-3ubuntu2","0.40.0-5ubuntu1","0.40.0-5ubuntu2","0.40.0-5ubuntu3","0.41.0-2ubuntu3","0.41.0-2ubuntu4"],"ecosystem_specific":{"binaries":[{"binary_name":"libmpv2","binary_version":"0.41.0-2ubuntu4"},{"binary_name":"mpv","binary_version":"0.41.0-2ubuntu4"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-123095.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]}