CVE-2026-123095

The mpv media player (versions 0.29.0 before 0.42.0 ) is vulnerable to a playlist injection flaw in the bundled ytdl_hook script. The root cause is the improper neutralization of CRLF sequences, allowing remote attackers to bypass the url_is_safe() check by embedding newlines in playlist URLs. Th...