CVE-2026-123095
Description
A flaw was found in mpv. A remote attacker who controls a media feed or webpage can exploit this vulnerability by injecting newline characters into playlist URLs processed by the bundled ytdl_hook script. This allows the attacker to bypass URL safety checks and load arbitrary local files or shared libraries, leading to arbitrary code execution or unauthorized data access.
Statement
This vulnerability is rated as an Important impact because successful exploitation permits remote unauthenticated attackers to execute arbitrary code or expose sensitive local files, which warrants an elevated severity over Moderate while remaining below Critical due to requiring user interaction to open an untrusted media feed. In Red Hat enterprise deployments, the mpv media player is not distributed as part of core operating system installations, significantly reducing overall environmental exposure. Where the utility is deployed in workstation or desktop environments, the potential blast radius is limited to the privileges and system access rights of the user running the media playback process.
Mitigation
Disable the youtube-dl hook script in mpv configuration:
To disable the script globally across the system, add the following configuration directive to `/etc/mpv/mpv.conf`:
ytdl=no
Alternatively, configure the setting per user in `~/.config/mpv/mpv.conf`:
ytdl=no
For individual command-line invocations, launch mpv with the `--no-ytdl` flag:
mpv --no-ytdl <url_or_file>
In addition, avoid opening untrusted playlist files, media feeds, or streaming links from unverified sources.
Caveats:
Disabling the youtube-dl hook prevents mpv from parsing and playing media directly from external video platforms that rely on youtube-dl or yt-dlp. Any currently running mpv playback sessions must be stopped and restarted for configuration file changes to take effect.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
