The issue allows remote attackers to execute arbitrary code via a crafted web site. This is because mpv reads HTML documents containing VIDEO elements and accepts arbitrary URLs in a `src` attribute without a protocol whitelist in `player/lua/ytdl hook.lua`. For example, an URL like `av://lavfi:ladspa=file=` can signify that the product should call `dlopen` on a shared object file located at an arbitrary local pathname. The problem exists because the product does not consider that youtube-dl can provide a potentially unsafe URL.