Is there a public PoC exploit available for CVE-2026-50230?

Yes, a public proof-of-concept exploit is available for CVE-2026-50230. Prioritise patching immediately. EPSS: 0.0%.

Lyrion Music Server CVE-2026-50230

Q: What is the CVSS score of CVE-2026-50230?

CVE-2026-50230 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34829 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-05 VulnCheck

GHSA-rxf9-fjjc-h697

XSS Lyrion Music Server Lms Community

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jun 05, 2026 - 14:22 NVD

6.1 (MEDIUM) 5.1 (MEDIUM)

Analysis Generated

Jun 05, 2026 - 14:19 vuln.today

DescriptionCVE.org

Lyrion Music Server 9.2.0 contains an unauthenticated reflected cross-site scripting vulnerability in the server.log endpoint that allows attackers to inject arbitrary HTML and JavaScript code through the search parameter. Attackers can craft malicious URLs with JavaScript payloads in the search parameter to execute code in users' browsers within the context of the affected application.

AnalysisAI

Reflected cross-site scripting in Lyrion Music Server 9.2.0 allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL targeting the server.log endpoint's search parameter. The vulnerability carries a changed scope (S:C in CVSS), meaning malicious script executes in the context of the affected application's origin, enabling session theft, credential harvesting, or UI redressing against users of the media server interface. No public exploit is confirmed at time of analysis, and no KEV listing exists, but the advisory was published to zeroscience.mk - a research outlet that routinely accompanies disclosures with proof-of-concept code.

Technical ContextAI

Lyrion Music Server (formerly Logitech Media Server / Squeezebox Server) is an open-source music streaming server maintained by the lms_community project. The affected endpoint, server.log, exposes a search parameter that is reflected back into the HTML response without sufficient output encoding or sanitization, a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) defect. The CPE string cpe:2.3:a:lms_community:lyrion_music_server:*:*:*:*:*:*:*:* uses a wildcard version field, indicating NVD has not bounded the affected range to only 9.2.0 - earlier versions may also be vulnerable. The CVSS changed-scope indicator (S:C) reflects that the injected script executes in the browser's security context for the Lyrion origin, separate from the attacker's origin, which is the hallmark of reflected XSS with cross-origin impact potential.

RemediationAI

No vendor-released patch or fixed version is identified in the available data - the CPE wildcard and absence of a patch reference in either advisory confirm this. Administrators should monitor the official Lyrion Music Server repository and the zeroscience.mk advisory (https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5988.php) for a patched release. As an immediate compensating control, restrict network access to the Lyrion web interface using firewall rules or reverse-proxy ACLs so only trusted internal hosts can reach it - this eliminates the network-delivered crafted-URL attack path entirely without affecting local playback functionality. If the server.log endpoint is not operationally required, disable or block access to that specific path at the reverse proxy layer. Deploying a Content Security Policy (CSP) header that disallows inline script execution would mitigate reflected XSS impact if added at the web server or proxy layer, though this requires infrastructure changes and may break legitimate UI features. Educate users not to follow unsolicited links to the Lyrion interface from external sources until a patch is available.