CVE-2026-49130Medium· 5.3▾ TwilightPoC availableMusic Player Daemon (MPD) before version 0.24.11 contains a CRLF injection vulnerability in the xspf_char_data function within the XSPF playlist plugin that allows attackers to embed literal CR/LF bytes in URI fields by supplying a malic…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
Music Player Daemon (MPD) before version 0.24.11 contains a CRLF injection vulnerability in the xspf_char_data function within the XSPF playlist plugin that allows attackers to embed literal CR/LF bytes in URI fields by supplying a malicious XSPF playlist with XML numeric character references. Attackers can inject forged key-value lines through the location field into MPD protocol responses including playlistinfo, currentsong, and listplaylist outputs, as well as the state file writer, by exploiting Expat's decoding of numeric character references prior to the character data callback.
MPD < 0.24.11Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-49128High· 7.5Music Player Daemon < 0.24.11 Path Traversal via LocalStorage URI Handling
CVE-2026-49127High· 8.6Music Player Daemon < 0.24.11 Stack Buffer Overflow via pcm_unpack_24be
CVE-2026-49129Medium· 5.8Music Player Daemon < 0.24.11 SSRF via CurlInputPlugin
CVE-2026-121946High· 7.2zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 CRLF Header Injection via Message Builders
CVE-2026-57154High· 8.1OPNsense: Configuration line injection via multiple GUI text fields
CVE-2026-3634Low· 3.9Libsoup: libsoup: http header injection and response splitting via crlf injection in content-type header