CVE-2018-6360
libmpv2: mpv through 0.28.0 allows remote attackers to execute arbitrary code via acrafted web site, because it reads HTML doc...
CVE-2018-6360 is fixed in 3 products on 1 platform, first by libmpv1 0.27.2-1ubuntu1, released January 27, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0259
85th percentile
mpv through 0.28.0 allows remote attackers to execute arbitrary code via acrafted web site, because it reads HTML documents containing VIDEOelements, and accepts arbitrary URLs in a src attribute without a protocolwhitelist in player/lua/ytdl_hook.lua. For example, anav://lavfi:ladspa=file= URL signifies that the product should call dlopenon a shared object file located at an arbitrary local pathname. The issueexists because the product does not consider that youtube-dl can provide apotentially unsafe URL.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| libmpv1 · Ubuntu 18.04.6 LTS (bionic) | 0.27.2-1ubuntu1 | libmpv1 0.27.2-1ubuntu1 | Jan 27, 2018 |
| libmpv2 · Ubuntu 24.10 (oracular) | 0.27.2-1ubuntu1 | libmpv2 0.27.2-1ubuntu1 | Jan 16, 2026 |
| libmpv2 · Ubuntu 25.04 (plucky) | 0.27.2-1ubuntu1 | libmpv2 0.27.2-1ubuntu1 | Jan 16, 2026 |
| mpv · Ubuntu 18.04.6 LTS (bionic) | 0.27.2-1ubuntu1 | mpv 0.27.2-1ubuntu1 | Jan 27, 2018 |
| mpv · Ubuntu 24.10 (oracular) | 0.27.2-1ubuntu1 | mpv 0.27.2-1ubuntu1 | Jan 16, 2026 |
| mpv · Ubuntu 25.04 (plucky) | 0.27.2-1ubuntu1 | mpv 0.27.2-1ubuntu1 | Jan 16, 2026 |