6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25578

CVE-2026-25578: Navidrome is vulnerable to XSS via comment from song metadata

Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, a cross-site scripting vulnerability in the frontend allows a malicious attacker to inject code through the comment metadata of a song to exfiltrate user credentials. This issue has been patched in version 0.60.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25578

CVE-2026-25578:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/navidrome/navidrome	go	< 0.60.0	0.60.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Cross-Site Scripting (XSS) issue within the Navidrome frontend, caused by the improper use of React's dangerouslySetInnerHTML property. This function was used in several components to render metadata from music files, such as song comments, album notes, and artist biographies. The core of the issue lies in the MultiLineTextField component, which was explicitly designed to take text input (like a song's comment) and render it as HTML without any sanitization. An attacker could embed malicious HTML and JavaScript code (e.g., <img src=x onerror=... >) into a song's metadata. When a Navidrome user views the details of this malicious song, the script would execute in their browser, allowing the attacker to steal sensitive information like the user's API token from local storage.

The security patch addresses this by systematically removing the usage of dangerouslySetInnerHTML where it's not needed or by wrapping the content in a new SafeHTML component. This new component utilizes the DOMPurify library to sanitize the HTML, removing any potentially malicious code before it is rendered. The analysis of the commit d7ec7355c9036d5be659d6ac555c334bb5848ba6 clearly shows the removal of the vulnerable code in components like MultiLineTextField, AlbumDetails, DesktopArtistDetails, MobileArtistDetails, and Linkify, and the introduction of the SafeHTML component as the primary mitigation.

Vulnerable functions

MultiLineTextField

ui/src/common/MultiLineTextField.jsx

The MultiLineTextField component was vulnerable to XSS because it used `dangerouslySetInnerHTML` to render lines from song metadata (like comments) without sanitization. An attacker could craft a malicious comment with HTML and JavaScript, which would be executed in the user's browser when viewing song information.

AlbumDetails

ui/src/album/AlbumDetails.jsx

The AlbumDetails component directly rendered album notes using `dangerouslySetInnerHTML`, creating an XSS vulnerability. The patch replaced this with a new `SafeHTML` component that sanitizes the content before rendering.

DesktopArtistDetails

ui/src/artist/DesktopArtistDetails.jsx

The DesktopArtistDetails component was vulnerable to XSS as it rendered the artist's biography using `dangerouslySetInnerHTML` without sanitization. This was replaced by the `SafeHTML` component to mitigate the vulnerability.

MobileArtistDetails

ui/src/artist/MobileArtistDetails.jsx

Similar to the desktop version, the MobileArtistDetails component used `dangerouslySetInnerHTML` to render the artist's biography, leading to an XSS vulnerability. The fix involves using the `SafeHTML` component for sanitization.

Linkify

ui/src/common/Linkify.jsx

The Linkify component used `dangerouslySetInnerHTML` to render parts of a text string, which could lead to XSS if the text contained malicious HTML. The patch removes this unsafe rendering.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.