CVE-2026-47114: Iina

High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days.

IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbitrary commands by supplying malicious mpv_-prefixed query parameters through the iina://open custom URL scheme handler. Attackers can deliver a crafted URL via a browser that passes unvalidated mpv_options/input-commands parameters into the mpv runtime, causing arbitrary command execution as the current macOS user upon approval of the browser protocol prompt without requiring a valid media file.

Affected products

• Iina Iina: before 1.4.3 (fixed in 1.4.3)

Published 2026-05-21. Last modified 2026-07-23.