IINA, a media player for macOS, contains a user-assisted command execution vulnerability that allows an attacker to craft an iina://open URL with malicious mpv_-prefixed query parameters such as mpv_options or input-commands, which the player then passes unverified to the mpv runtime when the browser prompts the user to open the protocol, enabling arbitrary code to run as the current macOS user; this flaw is classified as CWE‑88 and can lead to full remote code execution.

All installations of IINA on macOS that use the iina://open URL scheme and are earlier than version 1.4.3 are affected, as the product vendor iina:iina has not yet removed the unsafe handling of mpv options in the URL scheme handler.

The CVSS base score of 8.6 indicates a high severity issue; EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalogue, suggesting limited or no widespread exploitation to date; however, exploitation requires the victim to approve a browser protocol prompt, making it a user‑interaction attack that can still be delivered by phishing or social engineering, and the combined factors imply a high risk for exposed users who are not updated.