Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, a cross-site scripting vulnerability in the frontend allows a malicious attacker to inject code through the comment metadata of a song to exfiltrate user credentials. This issue has been patched in version 0.60.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-25578 Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, a cross-site scripting vulnerability in the frontend allows a mal… https://www.cve.org/CVERecord?id=CVE-2026-25578
Post summary
The post announces CVE-2026-25578, a cross‑site scripting flaw in Navidrome versions before 0.60.0, but offers no further exploitation details or mitigation information.
CVE-2026-25578 Cross-Site Scripting in Navidrome Music Server Before 0.60.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25578
Post summary
The text announces a cross‑site scripting vulnerability affecting Navidrome Music Server versions prior to 0.60.0 and provides a link to detailed information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | navidrome | navidrome | - | - | - |