Read the docs
TI-2026-34707 Aliases CVE-2026-47114GHSA-55r7-xx3w-x2wf

IINA < 1.4.3 Command Execution via iina://open URL Scheme

Priority HIGH 72CWE-88Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-88.

Summary

IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbitrary commands by supplying malicious mpv_-prefixed query parameters through the iina://open custom URL scheme handler. Attackers can deliver a crafted URL via a browser that passes unvalidated mpv_options/input-commands parameters into the mpv runtime, causing arbitrary command execution as the current macOS user upon approval of the browser protocol prompt without requiring a valid media file.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00702 53rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed iina (iina): 1.4.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
iinaiinabefore 1.4.31.4.3Patch availableCNA
  • iina Vendoriina Affected before 1.4.3 Fixed in 1.4.3 Patch available CNA

Remediation

  • Fix · CNA iina (iina) Fixed in 1.4.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47114
  2. 2026-10-03 Alias added: GHSA-55r7-xx3w-x2wf

References

Exploit 1

Patch 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences