mpv-player vulnerabilities and threats

mpv versions from 0.29.0 up to but not including 0.42.0 contain a CRLF injection vulnerability in the bundled ytdl_hook script. This flaw allows remote attackers who control a feed or page to inject unchecked playlist entries by embedding newline characters in playlist URLs. Exploitation can bypass url_is_safe() checks to open local file URLs or av:// inputs, potentially leading to local file reading or code execution via loading shared objects through ladspa.