Lyrion Music Server EUVD-2026-34834

Q: What is the CVSS score of EUVD-2026-34834?

EUVD-2026-34834 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-50235 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-05 VulnCheck

GHSA-qpxh-62pf-qh76

XSS Lyrion Music Server Lms Community

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jun 05, 2026 - 14:22 NVD

6.1 (MEDIUM) 5.1 (MEDIUM)

Analysis Generated

Jun 05, 2026 - 14:18 vuln.today

DescriptionCVE.org

Lyrion Music Server 9.2.0 contains a reflected cross-site scripting vulnerability in advanced search parameters that fail to properly sanitize user input before displaying it in search forms. Attackers can inject malicious scripts through unfiltered search parameters to execute arbitrary JavaScript in users' browsers and steal session information.

AnalysisAI

Reflected cross-site scripting in Lyrion Music Server 9.2.0 allows unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers via unsanitized advanced search parameters, enabling session token theft and account hijacking with a single user-click interaction. The changed scope (S:C) in the CVSS vector confirms the injected script executes outside the origin of the vulnerable application, amplifying cross-domain impact. No public exploit identified at time of analysis and no CISA KEV listing, but the ZeroScience Lab advisory reference is a known PoC-publishing outlet - PoC availability should be treated as likely pending confirmation.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-controlled search parameter values are reflected directly into HTML responses without encoding or sanitization, allowing script injection. Lyrion Music Server (formerly Logitech Media Server / Squeezebox Server) is an open-source music streaming server maintained by the lms_community project. The affected CPE - cpe:2.3:a:lms_community:lyrion_music_server:*:*:*:*:*:*:*:* - uses a wildcard version field, indicating NVD has not constrained the vulnerable range beyond what the description specifies (9.2.0). The reflected XSS vector targets the advanced search form, meaning the malicious payload must be delivered via URL parameter and is not stored server-side. The S:C (scope changed) CVSS component indicates the JavaScript executes in the victim's browser security context rather than the server's, enabling cross-origin actions such as credential harvesting.

RemediationAI

No vendor-released patch version was identified in the provided data at time of analysis. Administrators should monitor the Lyrion Music Server project releases and the VulnCheck advisory (https://www.vulncheck.com/advisories/lyrion-music-server-reflected-xss-via-search-parameters) for patch availability. As a compensating control, restrict access to the Lyrion Music Server web interface to trusted internal networks or VPN-only access - this eliminates the network delivery path for the reflected XSS payload and is the most effective interim mitigation, at the cost of remote accessibility. If internet exposure is required, deploy a web application firewall (WAF) rule to block or sanitize query parameters containing script tags or JavaScript URI patterns in search endpoints, noting that WAF-based XSS filtering can be bypassed by sophisticated encodings and is not a substitute for a code-level fix. Content Security Policy (CSP) headers restricting inline script execution would reduce exploitability as a defense-in-depth measure if configurable at the reverse-proxy layer.