CVE-2026-47114

HIGH 8.8

IINA < 1.4.3 Command Execution via iina://open URL Scheme

CVSS Score

8.8

EPSS Score

0.2%

EPSS Percentile

36th

IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbitrary commands by supplying malicious mpv_-prefixed query parameters through the iina://open custom URL scheme handler. Attackers can deliver a crafted URL via a browser that passes unvalidated mpv_options/input-commands parameters into the mpv runtime, causing arbitrary command execution as the current macOS user upon approval of the browser protocol prompt without requiring a valid media file.

CWE	CWE-88
Vendor	iina
Product	iina
Published	May 21, 2026
Last Updated	May 22, 2026

Stay Ahead of the Next One

Get instant alerts for iina iina

Be the first to know when new high vulnerabilities affecting iina iina are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

iina / iina

0 < 1.4.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

binary.stackpointer.re: https://binary.stackpointer.re/iina-142-url-scheme-command-execution github.com: https://github.com/iina/iina/releases/tag/v1.4.3 github.com: https://github.com/iina/iina/commit/1e6f43248dab9d6ae303781c790e5315cbc9fcef vulncheck.com: https://www.vulncheck.com/advisories/iina-command-execution-via-iina-open-url-scheme

Credits

stackpointer