{"id":"CVE-2026-49130","summary":"Music Player Daemon \u003c 0.24.11 CRLF Injection via XspfPlaylistPlugin.cxx","details":"Music Player Daemon (MPD) before version 0.24.11 contains a CRLF injection vulnerability in the xspf_char_data function within the XSPF playlist plugin that allows attackers to embed literal CR/LF bytes in URI fields by supplying a malicious XSPF playlist with XML numeric character references. Attackers can inject forged key-value lines through the location field into MPD protocol responses including playlistinfo, currentsong, and listplaylist outputs, as well as the state file writer, by exploiting Expat's decoding of numeric character references prior to the character data callback.","modified":"2026-08-12T16:25:33.517165Z","published":"2026-05-28T19:12:42.644Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-93"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49130.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49130.json"},{"type":"ADVISORY","url":"https://github.com/MusicPlayerDaemon/MPD/releases/tag/v0.24.11"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49130"},{"type":"ADVISORY","url":"https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24.11/NEWS"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/music-player-daemon-crlf-injection-via-xspfplaylistplugin-cxx"},{"type":"REPORT","url":"https://github.com/MusicPlayerDaemon/MPD/issues/2483"},{"type":"FIX","url":"https://github.com/MusicPlayerDaemon/MPD/commit/855085b35c67dddeef0652e2cb3ac8cdd4f457b7"},{"type":"FIX","url":"https://www.musicpd.org/news/2026/05/mpd-0-24-11-released/"},{"type":"PACKAGE","url":"https://github.com/MusicPlayerDaemon/MPD"},{"type":"EVIDENCE","url":"https://mstreet97.github.io/security-research/opensource/vulnerability-disclosure/cybersecurity/cve/2026/05/25/Four_Bugs_Reachable_nc.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/musicplayerdaemon/mpd","events":[{"introduced":"0"},{"fixed":"0fd151f7469b4658b18b39b5c886dd8246149abc"},{"fixed":"855085b35c67dddeef0652e2cb3ac8cdd4f457b7"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"0.24.11"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v0.24.10","v0.24.9","v0.24.8","v0.24.7","v0.24.6","v0.24.5","v0.24.4","v0.24.3","v0.24.2","v0.24.1","v0.24","v0.23.5","v0.23.4","v0.23.3","v0.23.2","v0.23.1","v0.23","v0.22","v0.21.5","v0.21.4","v0.21.3","v0.21.2","v0.21.1","v0.21","v0.20.3","v0.20.2","v0.20.1","v0.20","v0.19.1","v0.19","v0.18.4","v0.18.3","v0.18.2","v0.18.1","v0.18","v0.17","v0.16","v0.16_alpha3","v0.16_alpha2","v0.16_alpha1","v0.15","v0.15_beta2","v0.15_beta1","v0.15_alpha1","v0.14","v0.14_beta3","v0.14_beta2","v0.14_beta1","v0.14_alpha3","v0.14_alpha2","v0.14_alpha1"],"database_specific":{"vanir_signatures":[{"source":"https://github.com/musicplayerdaemon/mpd/commit/855085b35c67dddeef0652e2cb3ac8cdd4f457b7","target":{"function":"xspf_end_element","file":"src/playlist/plugins/XspfPlaylistPlugin.cxx"},"deprecated":false,"digest":{"function_hash":"333891119695936176893207139568500593963","length":928},"id":"CVE-2026-49130-3f7830b4","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"171350325519728339041003066125876017895","length":440},"id":"CVE-2026-49130-47e59ce6","signature_type":"Function","signature_version":"v1","source":"https://github.com/musicplayerdaemon/mpd/commit/855085b35c67dddeef0652e2cb3ac8cdd4f457b7","target":{"file":"src/playlist/plugins/RssPlaylistPlugin.cxx","function":"rss_end_element"}},{"deprecated":false,"digest":{"line_hashes":["17975483159873417758786990640658488051","26685130837143989253104725932140823993","310727274378174808275253050732599084485","336969836835941904371629830985783706846","180793420866909452546838289503739683793","300657109487113381178873657248020458269","37387876769976407466004253968500912240","89974823686695160386131780919307550339"],"threshold":0.9},"id":"CVE-2026-49130-47ec6d18","signature_type":"Line","signature_version":"v1","source":"https://github.com/musicplayerdaemon/mpd/commit/855085b35c67dddeef0652e2cb3ac8cdd4f457b7","target":{"file":"src/playlist/plugins/PlsPlaylistPlugin.cxx"}},{"target":{"file":"src/playlist/plugins/XspfPlaylistPlugin.cxx"},"deprecated":false,"digest":{"line_hashes":["316297300759595289611710752982927524778","160605690509896462659358228588543920976","186776768476255891989042558287445800945","304466107820799073030040762617564655304","91012762010176938432018811492713913875","206806893496046382081888240522882907853","180429325242908220003023312925675868858"],"threshold":0.9},"id":"CVE-2026-49130-7234f82f","signature_type":"Line","signature_version":"v1","source":"https://github.com/musicplayerdaemon/mpd/commit/855085b35c67dddeef0652e2cb3ac8cdd4f457b7"},{"deprecated":false,"digest":{"function_hash":"41481930935941850650546239083224380329","length":2036},"id":"CVE-2026-49130-a8159a73","signature_type":"Function","signature_version":"v1","source":"https://github.com/musicplayerdaemon/mpd/commit/855085b35c67dddeef0652e2cb3ac8cdd4f457b7","target":{"file":"src/playlist/plugins/PlsPlaylistPlugin.cxx","function":"ParsePls"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/musicplayerdaemon/mpd/commit/855085b35c67dddeef0652e2cb3ac8cdd4f457b7","target":{"file":"src/playlist/plugins/RssPlaylistPlugin.cxx"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["62558712492474036218347089872635361519","214182792903434244901821549026128074888","25327966031648383457808775471029918826","77755788627986770447467776173803307651","74639485970512919668708628211194601789","225791938050820790377407899743370188017","79818744431910772130359408010564197417","74338841774275354929466275692787462384"]},"id":"CVE-2026-49130-d092c729"},{"deprecated":false,"digest":{"length":582,"function_hash":"96740534488987055041951366488288349595"},"id":"CVE-2026-49130-de009e33","signature_type":"Function","signature_version":"v1","source":"https://github.com/musicplayerdaemon/mpd/commit/855085b35c67dddeef0652e2cb3ac8cdd4f457b7","target":{"file":"src/playlist/plugins/AsxPlaylistPlugin.cxx","function":"asx_end_element"}},{"signature_version":"v1","source":"https://github.com/musicplayerdaemon/mpd/commit/855085b35c67dddeef0652e2cb3ac8cdd4f457b7","target":{"file":"src/playlist/plugins/AsxPlaylistPlugin.cxx"},"deprecated":false,"digest":{"line_hashes":["99919519214114178489034538707609319816","137448491096024712407725590926955355582","302799126041345785683028227936236115573","45882838130591445215640182509665970581","305958223925377994120172359892704718911","178761063399308229282024222644967849144","196387835948011137404690507036094344160"],"threshold":0.9},"id":"CVE-2026-49130-e6edf0fc","signature_type":"Line"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49130.json","vanir_signatures_modified":"2026-08-12T16:25:33Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}]}