CVE-2026-123095High· 7.5▾ Twilightmpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can b…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.5%
mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass url_is_safe() to open file:// or av:// inputs, reading local files or loading shared objects via ladspa for code execution.
mpv >= 0.29.0 < 0.42.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123298Medium· 5.0In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible
CVE-2026-28296Medium· 4.3Gvfs: ftp gvfs backend: arbitrary ftp command injection via crlf sequences in file paths
CVE-2026-1536Medium· 5.8Libsoup: libsoup: http header injection or response splitting via crlf injection in content-disposition header
CVE-2026-1467Medium· 5.8Libsoup: libsoup: http header injection via specially crafted urls when an http proxy is configured
CVE-2026-121946High· 7.2zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders
CVE-2026-121432Low· 3.5AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist