mpv bundled ytdl_hook playlist injection lets attackers read local files
If you play a malicious page in the mpv video player, your files can be peeked at.
Summary
A playlist injection flaw in the ytdl_hook script bundled with the mpv video player lets remote attackers who control a feed or page read local files or load shared objects to run code. Versions from 0.29.0 before 0.42.0 are affected.
Affected when
- Playing a URL from a feed or page an attacker controls
What to do
Update mpv to 0.42.0.
Products and platforms
CVE IDs
Sources
Times
First published
First seen