CVE-2026-47114 — IINA < 1.4.3 Command Execution via iina://open URL Scheme
IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbitrary commands by supplying malicious mpv_-prefixed query …
Published: 2026-05-21 · CVSS: 8.6 · CVSS 4.0
IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbitrary commands by supplying malicious mpv_-prefixed query parameters through the iina://open custom URL scheme handler. Attackers can deliver a crafted URL via a browser that passes unvalidated mpv_options/input-commands parameters into the mpv runtime, causing arbitrary command execution as the current macOS user upon approval of the browser protocol prompt without requiring a valid media file.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7