Executive brief
IINA is a popular open-source media player for macOS. A vulnerability in how the application handles custom web links (URLs) allows an attacker to execute unauthorized commands on a user's computer. To exploit this, an attacker would need to trick a user into clicking a malicious link and approving a browser prompt, which could lead to full system compromise or data theft.
Technical details
A command execution vulnerability exists in IINA versions prior to 1.4.3 due to improper neutralization of argument delimiters (CWE-88) within its custom URL scheme handler. The application fails to validate 'mpv_'-prefixed query parameters, specifically 'input-commands', when they are passed through the 'iina://open' protocol. A remote attacker can craft a malicious URL that, when opened by a user and accepted via the browser's protocol handler prompt, injects arbitrary commands into the underlying mpv runtime. This allows for code execution with the privileges of the current macOS user without requiring the presence of a valid media file. The issue was addressed in version 1.4.3 by rejecting 'input-command' options in the URL parser.
Affected products
- IINA IINA before 1.4.3
Timeline
- 2026-05-20: patched: Version 1.4.3 released
- 2026-05-21: advisory: NVD and VulnCheck published advisory