Arbitrary code execution

[Vendicated]

This extension allows any site to run arbitrary .so files on your computer

This can be done via open("http://localhost:7531/?play_url=${URLENCODE(av://lavfi:ladspa=file=/some/evil/so/here.so)}", "_blank")

See also mpv-player/mpv#7985

Here's a demonstration

simplescreenrecorder-2022-11-14_23.57.07.mp4

[eylles]

i just happen to read on that as i'm finding it useful for the current adblock problem, as i wanted to also address my issue with the python server script launching multiple instances, it seems mpv-handler solved the issue by limiting the uri schemes to only the safe ones.