CVE-2026-25578
📋 TL;DR
Navidrome versions before 0.60.0 contain a cross-site scripting vulnerability in the frontend that allows attackers to inject malicious code through song comment metadata. This could lead to credential theft from authenticated users. Anyone running Navidrome servers with the vulnerable version is affected.
💻 Affected Systems
- Navidrome
📦 What is this software?
Navidrome by Navidrome
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal administrator credentials, gain full control of the Navidrome server, and potentially compromise the underlying host system.
Likely Case
Attackers steal user session cookies or credentials, gaining unauthorized access to music libraries and potentially using the server for further attacks.
If Mitigated
With proper input validation and output encoding, malicious scripts are neutralized before execution, preventing credential theft.
🎯 Exploit Status
Exploitation requires user interaction (viewing malicious song metadata) but the XSS injection itself is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.60.0
Vendor Advisory: https://github.com/navidrome/navidrome/security/advisories/GHSA-rh3r-8pxm-hg4w
Restart Required: Yes
Instructions:
1. Backup your Navidrome configuration and database. 2. Stop the Navidrome service. 3. Update to version 0.60.0 using your package manager or by downloading from GitHub releases. 4. Restart the Navidrome service. 5. Verify the update was successful.
🔧 Temporary Workarounds
Disable user comments
allRemove or disable the comment metadata field functionality if possible in your configuration
Implement WAF rules
allAdd web application firewall rules to block script injection patterns in metadata fields
🧯 If You Can't Patch
- Isolate the Navidrome server from sensitive networks and limit user access
- Implement strict Content Security Policy headers to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Check your Navidrome version - if it's below 0.60.0, you are vulnerableCheck Version:
Check the Navidrome web interface settings page or run: navidrome --versionVerify Fix Applied:
After updating, verify the version is 0.60.0 or higher and test that script tags in comment metadata are properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual metadata updates with script tags or JavaScript code in comment fields
- Multiple failed login attempts from unexpected locations
Network Indicators:
- Outbound connections to suspicious domains from the Navidrome server
- Unexpected data exfiltration patterns
SIEM Query:
source="navidrome" AND (message="*<script>*" OR message="*javascript:*")