Both man mplayer and man mpv warning about -playlist option:


Play files according to a playlist file (Supports some common formats. If no format is detected, it will be treated as list of files, separated by newline characters. Note that XML playlist formats are not supported.)

You can play playlists directly and without this option, however, this option disables any security mechanisms that might be in place. You may also need this option to load plaintext files as playlist.


The way mpv uses playlist files via --playlist is not safe against maliciously constructed files. Such files may trigger harmful actions. This has been the case for all mpv and MPlayer versions, but unfortunately this fact was not well documented earlier, and some people have even misguidedly recommended use of --playlist with untrusted sources. Do NOT use --playlist with random internet sources or files you do not trust!

Playlist can contain entries using other protocols, such as local files, or (most severely), special protocols like avdevice://, which are inherently unsafe.

But how to protect our own if we never seen the example of maliciously constructed files ?

I know av://v4l2:/dev/video0 and tv://(mpv has disabled it) can record webcam, but is it possible record with silent (-novideo) with just filename ? Or can it upload to external ip with just filename ? What are the possible crafted malicious filenames or protocols we should aware of ?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.