Filtered by vendor Iina Subscriptions
Total 1 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-47114 1 Iina 1 Iina 2026-05-22 8.8 High
IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbitrary commands by supplying malicious mpv_-prefixed query parameters through the iina://open custom URL scheme handler. Attackers can deliver a crafted URL via a browser that passes unvalidated mpv_options/input-commands parameters into the mpv runtime, causing arbitrary command execution as the current macOS user upon approval of the browser protocol prompt without requiring a valid media file.