EUVD-2026-34831
GHSA-v3rr-mvqc-gmm2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through media file metadata tags like GENRE, ARTIST, and ALBUM. Attackers can craft files with XSS payloads in metadata tags that execute in the web interface when users view track information or play files, enabling access to management functions and settings disclosure.
AnalysisAI
Stored cross-site scripting in Lyrion Music Server 9.2.0 allows remote attackers to inject JavaScript payloads via media file metadata fields (GENRE, ARTIST, ALBUM) that execute when other users browse the web interface. With CVSS 7.2 and a changed scope, successful exploitation can reach management functions and disclose settings. No public exploit identified at time of analysis, and no CISA KEV listing.
Technical ContextAI
Lyrion Music Server (formerly Logitech Media Server, maintained by the LMS Community per CPE cpe:2.3:a:lms_community:lyrion_music_server) is a network media streaming server that indexes audio files and exposes a browser-based management UI. The flaw is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation): metadata tags embedded in audio files (ID3 GENRE, ARTIST, ALBUM, etc.) are read into the indexer and rendered to the web UI without sufficient HTML/JS escaping, so scripts stored in tag values execute under the origin of the music server when the track view or playback view is loaded.
RemediationAI
No vendor-released patch identified at time of analysis in the supplied references, so operators should monitor the Lyrion Music Server project (LMS Community) for a fixed release beyond 9.2.0 and apply it once published; consult the VulnCheck advisory (https://www.vulncheck.com/advisories/lyrion-music-server-stored-xss-via-metadata-tags) and the Zero Science Lab advisory (https://www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5990.php) for ongoing updates. In the interim, restrict the web UI to trusted networks via firewall or reverse-proxy ACLs to limit who can render poisoned metadata, and avoid indexing audio files sourced from untrusted parties - pre-scrub library files by rewriting ID3/Vorbis tags with a sanitizer such as Mutagen or eyeD3 to strip angle brackets and script-like content (trade-off: this rewrites legitimate metadata and may affect display). Where the UI is exposed, fronting the server with a reverse proxy that injects a strict Content-Security-Policy disallowing inline script execution can blunt the payload, at the cost of breaking any in-UI scripting the application itself relies on.
More in Lyrion Music Server
View allReflected cross-site scripting in Lyrion Music Server 9.2.0 allows a remote unauthenticated attacker to inject and execu
Unauthenticated arbitrary file read in Lyrion Music Server 9.2.0 allows remote attackers to retrieve sensitive files fro
Arbitrary filesystem directory listing in Lyrion Music Server 9.2.0 exposes any host directory to remote unauthenticated
Reflected cross-site scripting in Lyrion Music Server 9.2.0 allows unauthenticated remote attackers to inject arbitrary
Stored cross-site scripting in Lyrion Music Server 9.2.0's log viewer allows unauthenticated remote attackers to inject
A stored cross-site scripting (XSS) vulnerability exists in the web interface of Lyrion Music Server <= 9.0.3. An authen
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today