mpv vulnerabilities

CVEs whose affected-version data names the mpv package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-123095High· 7.5

yesterday

mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines

mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can b…

▾ Twilightmpv-player · mpvEPSS 0.49%via CVEORG