PT-2026-42532 · Iina · Iina

Stackpointer · Published 2026-05-21 · Updated 2026-05-21 · CVE-2026-47114

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IINA versions prior to 1.4.3

Description A user-assisted command execution issue exists where remote attackers can execute arbitrary commands as the current macOS user. This occurs when a crafted URL is delivered via a browser using the 'iina://open' custom URL scheme handler. The flaw allows unvalidated mpv options and input-commands parameters, specifically those with the mpv prefix, to be passed into the mpv runtime. Execution occurs upon the user approving the browser protocol prompt and does not require a valid media file.

Recommendations Update to version 1.4.3 or later.

Exploit

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2026-47114

Affected Products

Iina

References · 7

• 🔥 https://binary.stackpointer.re/iina-142-url-scheme-command-execution · Exploit
• https://github.com/iina/iina/commit/1e6f43248dab9d6ae303781c790e5315cbc9fcef · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-47114 · Security Note
• https://github.com/iina/iina/releases/tag/v1.4.3 · Note
• https://t.me/CVEtracker/54540 · Telegram Post
• https://t.me/cveNotify/164470 · Telegram Post
• https://vulncheck.com/advisories/iina-command-execution-via-iina-open-url-scheme · Note