Threats tagged 'ghsa-8pc2-mgr8-m3xv'

mpv versions from 0.29.0 up to but not including 0.42.0 contain a playlist injection vulnerability in the bundled ytdl_hook script. This flaw allows remote attackers who control a feed or page to inject unchecked entries by embedding newlines in playlist URLs. Exploitation can bypass the url_is_safe() check to open file:// or av:// inputs, potentially enabling reading of local files or loading shared objects via ladspa for code execution.