# CVE-2026-47114: IINA < 1.4.3 command execution via `iina://open`
**Status:** Public advisory
**CVE:** CVE-2026-47114
**Reporter:** stackpointer
**Affected product:** IINA for macOS
**Confirmed vulnerable version:** IINA 1.4.2
**Affected range:** IINA before 1.4.3
**Fixed version:** IINA 1.4.3
**CWE:** CWE-88, Improper Neutralization of Argument Delimiters in a Command
**Severity:** High
**CVSS v4.0:** 8.6
**CVSS v3.1:** 8.8
**Discovery date:** 2026-05-16
**Public advisory date:** 2026-05-17
**CVE publication date:** 2026-05-21
## Summary
Before version 1.4.3 of IINA, command execution could be achieved via: combining `iina://open` with `mpv_options/input-commands` leading to the creation of urls that can run commands.
## Impact
The issue allowed command execution as the current macOS user after the user opened the link.
Confirmed impact:
- Browser-triggered command execution through `mpv_options/input-commands`
- Execution as the current macOS user
- No valid media file required
- Controlled file creation was demonstrated only inside a proof-of-concept directory
User interaction is required in the browser-delivered attack path because the browser asks whether to open the `iina://` custom protocol.
## User interaction and local reproduction note
When triggered from a webpage, the browser is expected to show a prompt asking whether to open IINA. That prompt is part of the user-interaction requirement.
For local reproduction, invoking the same URL with macOS `open 'iina://...'` may launch IINA directly because the action is initiated locally through LaunchServices rather than through a browser. This local behavior is useful for testing, but the remote attack scenario still requires a browser-delivered `iina://` URL and browser protocol prompt approval.
## Root cause
The root cause is unsafe forwarding of `mpv_` query parameters from a remote-triggerable custom URL scheme into mpv runtime options. The dangerous option confirmed in testing is `mpv_options/input-commands`, which can be interpreted by mpv as an input command list.
## FUN VIDEO PROOF OF CONCEPT
[Sit back and enjoy!](proof.mp4), If that video proof is not enough thats ok, here are 2 commands you can try yourself: `iina://open?url=http%3A%2F%2F127.0.0.1%3A225%2F225&mpv_options%2Finput-commands=run%20%22%2Fusr%2Fbin%2Ftouch%22%20%22%2Ftmp%2Fpwned%22`, `iina://open?url=http%3A%2F%2F127.0.0.1%3A225%2F225&mpv_options%2Finput-commands=run%20%22%2Fbin%2Frm%22%20%22%2Ftmp%2Fpwned%22`.
## Mitigation
Update to IINA 1.4.3
## Let's look at the fix!
```
for query in queries {
if query.name.hasPrefix("mpv_") {
let mpvOptionName = String(query.name.dropFirst(4))
+ guard !mpvOptionName.contains("input-command") else {
+ Logger.log("mpv option \(mpvOptionName) rejected when parsing URL", level: .warning)
+ continue
+ }
guard let mpvOptionValue = query.value else { continue }
Logger.log("Setting \(mpvOptionName) to \(mpvOptionValue)")
player.mpv.setString(mpvOptionName, mpvOptionValue)
```
## How long was the bug alive for? Lets find out!
The bug was introduced in https://github.com/iina/iina/commit/9ae2f4f91dd469b1d69a8b9cf6d877679eec00f8 on `2018-09-01` to the repo and first appeared in a tagged release on `2018-09-10` and the bug was removed in https://github.com/iina/iina/commit/1e6f43248dab9d6ae303781c790e5315cbc9fcef on `2026-05-20`. I tested and confirmed the bug in IINA 1.4.2 however, it seems it has been vulnerable since 2018!
## Disclosure timeline
- 2026-05-16: Issue discovered and validated locally
- 2026-05-17: Public advisory published
- 2026-05-17: CVE request submitted
- 2026-05-19: Vendor notified via GitHub issue (email to
[email protected] failed)
- 2026-05-20: Fix committed (7048ae7, 1e6f432)
- 2026-05-20: Vendor confirmed fix in IINA 1.4.3
- 2026-05-21: CVE-2026-47114 published by VulnCheck
## Credits
Discovered by stackpointer.