---
id: CVE-2026-47114
title: 'IINA < 1.4.3 Command Execution via iina://open URL Scheme'
summary: >-
  IINA before 1.4.3 contains a user-assisted command execution vulnerability
  that allows remote attackers to execute arbitrary commands by supplying
  malicious mpv_-prefixed query parameters through the iina://open custom URL
  scheme handler…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-88
vendor: iina
product: iina
affected:
  - iina < 1.4.3
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-05-22T13:39:03.737385Z'
exploitAvailable: true
published: '2026-05-21'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:04:07.491Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-47114'
references:
  - url: 'https://binary.stackpointer.re/iina-142-url-scheme-command-execution'
  - url: 'https://github.com/iina/iina/releases/tag/v1.4.3'
    label: iina 1.4.3 Release Notes
  - url: >-
      https://github.com/iina/iina/commit/1e6f43248dab9d6ae303781c790e5315cbc9fcef
  - url: >-
      https://www.vulncheck.com/advisories/iina-command-execution-via-iina-open-url-scheme
tags:
  - cve.org
  - exploit-available
epss: 0.00702
epssPercentile: 0.53492
ingestedAt: '2026-11-08T14:51:22.414Z'
---

## Overview

IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbitrary commands by supplying malicious mpv_-prefixed query parameters through the iina://open custom URL scheme handler. Attackers can deliver a crafted URL via a browser that passes unvalidated mpv_options/input-commands parameters into the mpv runtime, causing arbitrary command execution as the current macOS user upon approval of the browser protocol prompt without requiring a valid media file.

## Affected

- `iina < 1.4.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.