CVE-2026-49130

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-49130
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49130.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-49130
Downstream
Published
2026-05-28T19:12:42Z
Modified
2026-10-28T10:51:54Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Music Player Daemon < 0.24.11 CRLF Injection via XspfPlaylistPlugin.cxx
Details

Music Player Daemon (MPD) before version 0.24.11 contains a CRLF injection vulnerability in the xspf_char_data function within the XSPF playlist plugin that allows attackers to embed literal CR/LF bytes in URI fields by supplying a malicious XSPF playlist with XML numeric character references. Attackers can inject forged key-value lines through the location field into MPD protocol responses including playlistinfo, currentsong, and listplaylist outputs, as well as the state file writer, by exploiting Expat's decoding of numeric character references prior to the character data callback.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-93"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49130.json"
}
References

Affected packages

Git / github.com/musicplayerdaemon/mpd

Affected ranges

Type
GIT
Repo
https://github.com/musicplayerdaemon/mpd
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0fd151f7469b4658b18b39b5c886dd8246149abc
Fixed
855085b35c67dddeef0652e2cb3ac8cdd4f457b7
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.24.11"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "original_tag": "v0.24.11",
            "range": [
                {
                    "fixed": "0fd151f7469b4658b18b39b5c886dd8246149abc"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "range": [
                {
                    "fixed": "855085b35c67dddeef0652e2cb3ac8cdd4f457b7"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v0.*
v0.14
v0.14_alpha1
v0.14_alpha2
v0.14_alpha3
v0.14_beta1
v0.14_beta2
v0.14_beta3
v0.15
v0.15_alpha1
v0.15_beta1
v0.15_beta2
v0.16
v0.16_alpha1
v0.16_alpha2
v0.16_alpha3
v0.17
v0.18
v0.18.1
v0.18.2
v0.18.3
v0.18.4
v0.19
v0.19.1
v0.20
v0.20.1
v0.20.2
v0.20.3
v0.21
v0.21.1
v0.21.2
v0.21.3
v0.21.4
v0.21.5
v0.22
v0.23
v0.23.1
v0.23.2
v0.23.3
v0.23.4
v0.23.5
v0.24
v0.24.1
v0.24.10
v0.24.2
v0.24.3
v0.24.4
v0.24.5
v0.24.6
v0.24.7
v0.24.8
v0.24.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49130.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "333891119695936176893207139568500593963",
            "length": 928
        },
        "id": "CVE-2026-49130-3f7830b4",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/musicplayerdaemon/mpd/commit/855085b35c67dddeef0652e2cb3ac8cdd4f457b7",
        "target": {
            "file": "src/playlist/plugins/XspfPlaylistPlugin.cxx",
            "function": "xspf_end_element"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "171350325519728339041003066125876017895",
            "length": 440
        },
        "id": "CVE-2026-49130-47e59ce6",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/musicplayerdaemon/mpd/commit/855085b35c67dddeef0652e2cb3ac8cdd4f457b7",
        "target": {
            "file": "src/playlist/plugins/RssPlaylistPlugin.cxx",
            "function": "rss_end_element"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "17975483159873417758786990640658488051",
                "26685130837143989253104725932140823993",
                "310727274378174808275253050732599084485",
                "336969836835941904371629830985783706846",
                "180793420866909452546838289503739683793",
                "300657109487113381178873657248020458269",
                "37387876769976407466004253968500912240",
                "89974823686695160386131780919307550339"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-49130-47ec6d18",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/musicplayerdaemon/mpd/commit/855085b35c67dddeef0652e2cb3ac8cdd4f457b7",
        "target": {
            "file": "src/playlist/plugins/PlsPlaylistPlugin.cxx"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "316297300759595289611710752982927524778",
                "160605690509896462659358228588543920976",
                "186776768476255891989042558287445800945",
                "304466107820799073030040762617564655304",
                "91012762010176938432018811492713913875",
                "206806893496046382081888240522882907853",
                "180429325242908220003023312925675868858"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-49130-7234f82f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/musicplayerdaemon/mpd/commit/855085b35c67dddeef0652e2cb3ac8cdd4f457b7",
        "target": {
            "file": "src/playlist/plugins/XspfPlaylistPlugin.cxx"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "41481930935941850650546239083224380329",
            "length": 2036
        },
        "id": "CVE-2026-49130-a8159a73",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/musicplayerdaemon/mpd/commit/855085b35c67dddeef0652e2cb3ac8cdd4f457b7",
        "target": {
            "file": "src/playlist/plugins/PlsPlaylistPlugin.cxx",
            "function": "ParsePls"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "62558712492474036218347089872635361519",
                "214182792903434244901821549026128074888",
                "25327966031648383457808775471029918826",
                "77755788627986770447467776173803307651",
                "74639485970512919668708628211194601789",
                "225791938050820790377407899743370188017",
                "79818744431910772130359408010564197417",
                "74338841774275354929466275692787462384"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-49130-d092c729",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/musicplayerdaemon/mpd/commit/855085b35c67dddeef0652e2cb3ac8cdd4f457b7",
        "target": {
            "file": "src/playlist/plugins/RssPlaylistPlugin.cxx"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "96740534488987055041951366488288349595",
            "length": 582
        },
        "id": "CVE-2026-49130-de009e33",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/musicplayerdaemon/mpd/commit/855085b35c67dddeef0652e2cb3ac8cdd4f457b7",
        "target": {
            "file": "src/playlist/plugins/AsxPlaylistPlugin.cxx",
            "function": "asx_end_element"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "99919519214114178489034538707609319816",
                "137448491096024712407725590926955355582",
                "302799126041345785683028227936236115573",
                "45882838130591445215640182509665970581",
                "305958223925377994120172359892704718911",
                "178761063399308229282024222644967849144",
                "196387835948011137404690507036094344160"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-49130-e6edf0fc",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/musicplayerdaemon/mpd/commit/855085b35c67dddeef0652e2cb3ac8cdd4f457b7",
        "target": {
            "file": "src/playlist/plugins/AsxPlaylistPlugin.cxx"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T10:51:54Z"