node-mpv command injection vulnerability

node-mpv is a wrapper to use the mpv player for node.js. A command injection vulnerability exists in node-mpv 1.4.3 and earlier. An attacker can exploit this vulnerability to execute arbitrary commands via the options parameter...

CVE-2020-7632

node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...

CVE-2020-7632

node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...

Command injection

node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...

CVE-2020-7632

node-mpv (Node.js wrapper for mpv) up to version 1.4.3 is vulnerable to a Command Injection due to unsanitized control of the options argument. The root cause is that the options object can be crafted by an attacker to execute arbitrary commands, with network access and no user interaction requir...

CVE-2020-7632

node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...

@beargame/devdeck (>=1.1.0 <=1.1.4), @quran-cli/q-cli (>=1.0.0 <=1.1.3) +14 more potentially affected by CVE-2020-7632 via node-mpv (>=1.5.0 <=2.0.0-beta.2)

node-mpv NPM version =1.5.0, =1.1.0, =1.0.0, =0.1.1-alpha.1, =0.1.1, =0.0.1, =3.0.0, =0.1.0, =1.0.2, =1.0.9, =0.0.4, =1.0.0, =0.1.12, =0.1.15 and more Source cves: CVE-2020-7632 Source advisory: SNYK:JS-NODEMPV-564426...

Command Injection

Overview node-mpv is a wrapper to comfortably use mpv player with node.js. Affected versions of this package are vulnerable to Command Injection. The argument "options" can be controlled by users without any sanitization. PoC var Root = require"node-mpv"; var options = "binary": '" $touch JHU "'...

GLSA-201805-05 : mpv: Remote code execution

The remote host is affected by the vulnerability described in GLSA-201805-05 mpv: Remote code execution A vulnerability was discovered in mpv with the handling of HTML documents containing VIDEO elements. Additionally, mpv accepts arbitrary URLs in a src attribute without a protocol whitelist in...

mpv: Remote code execution

Background Video player based on MPlayer/mplayer2 Description A vulnerability was discovered in mpv with the handling of HTML documents containing VIDEO elements. Additionally, mpv accepts arbitrary URLs in a src attribute without a protocol whitelist in player/lua/ytdlhook.lua. Impact A remote...

MGASA-2018-0130 Updated mpv packages fix security vulnerability

Josef Gajdusek reported that mpv 0.27.0 was vulnerable to an attack through it's youtube-dl hook. This could cause remote code execution. This upstream update creates of list of sure protocols to use through the hook...

Updated mpv packages fix security vulnerability

Josef Gajdusek reported that mpv 0.27.0 was vulnerable to an attack through it's youtube-dl hook. This could cause remote code execution. This upstream update creates of list of sure protocols to use through the hook...

openSUSE Security Update : mpv (openSUSE-2018-173)

This update for mpv fixes the following issues : MPV was updated to version 0.27.2 Security issues fixed : - CVE-2018-6360: Additional fix for where mpv allowed remote attackers to execute arbitrary code via a crafted website, because it read HTML documents containing VIDEO elements, and accepts...

[ASA-201802-7] mpv: arbitrary code execution

Arch Linux Security Advisory ASA-201802-7 ========================================= Severity: High Date : 2018-02-13 CVE-ID : CVE-2018-6360 Package : mpv Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-605 Summary ======= The package mpv before version...

FreeBSD : mpv -- arbitrary code execution via crafted website (3ee6e521-0d32-11e8-99b0-d017c2987f9a)

mpv developers report : mpv through 0.28.0 allows remote attackers to execute arbitrary code via a crafted website, because it reads HTML documents containing VIDEO elements, and accepts arbitrary URLs in a src attribute without a protocol whitelist in player/lua/ytdlhook.lua. For example, an...

[SECURITY] [DSA 4105-2] mpv security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4105-2 [email protected] https://www.debian.org/security/ February 08, 2018 https://www.debian.org/security/faq - -------------------------------------------------------------------------...

[SECURITY] [DSA 4105-2] mpv security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4105-2 [email protected] https://www.debian.org/security/ February 08, 2018 https://www.debian.org/security/faq - -------------------------------------------------------------------------...

DSA-4105-2 mpv - regression update

Bulletin has no description...

Debian DSA-4105-1 : mpv - security update

It was discovered that mpv, a media player, was vulnerable to remote code execution attacks. An attacker could craft a malicious web page that, when used as an argument in mpv, could execute arbitrary code in the host of the mpv user. C Tenable Network Security, Inc. The descriptive text and...

[SECURITY] [DSA 4105-1] mpv security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4105-1 [email protected] https://www.debian.org/security/ February 06, 2018 https://www.debian.org/security/faq - -------------------------------------------------------------------------...