CVE-2026-123095 is a high-severity (CVSS 7.5) CWE-93 vulnerability. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.
mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unchecked entries by embedding newlines in playlist…
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Description
mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can bypass url_is_safe() to open file:// or av:// inputs, reading local files or loading shared objects via ladspa for code execution.
Detection & mitigation playbook
VulnerabilityDetect
Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).
Remediation status
The records we use list no fixed release for CVE-2026-123095. Check the upstream advisory for a patched version, and apply the exposure-reduction steps below in the meantime.
Mitigate without a patch
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
This vulnerability is rated as an Important impact because successful exploitation permits remote unauthenticated attackers to execute arbitrary code or expose sensitive local files, which warrants an elevated severity over Moderate while remaining below Critical due to requiring user interaction to open an untrusted…
Disable the youtube-dl hook script in mpv configuration: To disable the script globally across the system, add the following configuration directive to `/etc/mpv/mpv.conf`: ``` ytdl=no ``` Alternatively, configure the setting per user in `~/.config/mpv/mpv.conf`: ``` ytdl=no ``` For individual command-line invocations, launch mpv with the `--no-ytdl` flag: ``` mpv --no-ytdl <url_or_file> ``` In addition, avoid opening untrusted playlist files, media feeds, or streaming links from unverified sources. Caveats: Disabling the youtube-dl hook prevents mpv from parsing and playing media directly from external video platforms that rely on youtube-dl or yt-dlp. Any currently running mpv playback…Source: Red Hat security advisory for CVE-2026-123095 (CC BY 4.0)
Frequently Asked Questions
Is CVE-2026-123095 in your dependencies?
Find it across your dependency tree, including transitive dependencies.