Executive Summary

CVE-2026-50231 is an unauthenticated stored cross-site scripting (XSS) vulnerability found in Lyrion Music Server version 9.2.0 and earlier, specifically in the log viewer feature.

Attackers can exploit this vulnerability by injecting malicious scripts through unescaped template variables. They can do this via search, lines, and path query parameters or by crafting values that get logged, such as URLs, User-Agent headers, stream titles, or player names.

When exploited, this vulnerability allows arbitrary script execution in the browsers of users who view the affected logs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary script execution in the browsers of users who access the log viewer in Lyrion Music Server.

Such script execution can be used by attackers to steal sensitive information, hijack user sessions, perform actions on behalf of the user, or deliver further malicious payloads.

Because the vulnerability is unauthenticated, attackers do not need to be logged in to exploit it, increasing the risk of attack.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring and inspecting the log viewer feature of Lyrion Music Server 9.2.0 for unescaped template variables that allow script injection.

Specifically, you can check for suspicious or malicious script payloads in the search, lines, and path query parameters, as well as in logged values such as URLs, User-Agent headers, stream titles, or player names.

Commands to detect potential exploitation might include searching server logs for suspicious script tags or JavaScript payloads. For example, using grep on log files:

• grep -iE '<script|javascript:' /path/to/lyrion/logs/*
• grep -iE 'onerror=|onload=' /path/to/lyrion/logs/*

Additionally, monitoring HTTP requests for suspicious query parameters containing script payloads can be done via network capture tools or web server logs.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the log viewer feature to trusted users only, as the vulnerability allows unauthenticated attackers to inject scripts.

Additionally, sanitize and validate all input parameters such as search, lines, and path query parameters, and ensure that any logged values like URLs, User-Agent headers, stream titles, or player names are properly escaped before rendering.

If possible, update or patch Lyrion Music Server to a version where this vulnerability is fixed.

As a temporary workaround, consider disabling the log viewer feature until a patch is applied.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the CVE-2026-50231 vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0