The vulnerability arises from the ytdl_hook script bundled with mpv, which parses playlist URLs without properly sanitizing newline characters. By embedding newlines, an attacker can inject additional entries that bypass the url_is_safe() check and cause the player to treat the entries as file:// or av:// protocols. This permits reading local files and loading shared objects via ladspa, potentially resulting in arbitrary code execution on the host.

The flaw affects mpv-player's mpv from version 0.29.0 up to but excluding 0.42.0. Users running any version in that range on platforms where the ytdl_hook script is enabled are at risk.

The CVSS score of 7.7 categorises the issue as high severity. EPSS data is unavailable but the absence of a KEV listing indicates no publicly known exploitation yet. The likely attack vector is a remote attacker who can control the generation of a playlist file or a page served to the MPV client, injecting malicious URLs containing newline characters. If the victim's settings allow automatic execution of playlist entries, the injected file or ladspa modules could run with the privileges of the MPV process.