CVE-2026-49130: Improper Neutralization of CRLF Sequences ('CRLF Injection') in MusicPlayerDaemon MPD
Music Player Daemon (MPD) before version 0.24.11 contains a CRLF injection vulnerability in the xspf_char_data function within the XSPF playlist plugin that allows attackers to embed literal CR/LF bytes in URI fields by supplying a malicious XSPF playlist with XML numeric character references. Attackers can inject forged key-value lines through the location field into MPD protocol responses including playlistinfo, currentsong, and listplaylist outputs, as well as the state file writer, by exploiting Expat's decoding of numeric character references prior to the character data callback.
AI Analysis
Technical Summary
CVE-2026-49130 is a CRLF injection vulnerability in Music Player Daemon (MPD) before version 0.24.11. The issue exists in the xspf_char_data function of the XSPF playlist plugin, where attackers can embed literal CR/LF bytes in URI fields by supplying malicious XSPF playlists containing XML numeric character references. These injected characters lead to forged key-value lines in MPD protocol responses and state files due to Expat's decoding process prior to character data handling.
Potential Impact
Successful exploitation allows attackers to inject forged key-value lines into MPD protocol responses and state files, potentially leading to response manipulation or other downstream effects in applications consuming these outputs. The CVSS 4.0 base score is 6.9 (medium severity), indicating a moderate impact with network attack vector, no privileges or user interaction required, and limited impact on integrity.
Mitigation Recommendations
No official patch or remediation level has been confirmed as of the published date. Users should monitor the vendor's advisory channels for updates and apply any official fixes once available. Until then, avoid processing untrusted XSPF playlists or restrict access to MPD services to trusted users to reduce exposure.
CVE-2026-49130: Improper Neutralization of CRLF Sequences ('CRLF Injection') in MusicPlayerDaemon MPD
Description
Music Player Daemon (MPD) before version 0.24.11 contains a CRLF injection vulnerability in the xspf_char_data function within the XSPF playlist plugin that allows attackers to embed literal CR/LF bytes in URI fields by supplying a malicious XSPF playlist with XML numeric character references. Attackers can inject forged key-value lines through the location field into MPD protocol responses including playlistinfo, currentsong, and listplaylist outputs, as well as the state file writer, by exploiting Expat's decoding of numeric character references prior to the character data callback.
CVSS v4.0
Score 6.9medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-49130 is a CRLF injection vulnerability in Music Player Daemon (MPD) before version 0.24.11. The issue exists in the xspf_char_data function of the XSPF playlist plugin, where attackers can embed literal CR/LF bytes in URI fields by supplying malicious XSPF playlists containing XML numeric character references. These injected characters lead to forged key-value lines in MPD protocol responses and state files due to Expat's decoding process prior to character data handling.
Potential Impact
Successful exploitation allows attackers to inject forged key-value lines into MPD protocol responses and state files, potentially leading to response manipulation or other downstream effects in applications consuming these outputs. The CVSS 4.0 base score is 6.9 (medium severity), indicating a moderate impact with network attack vector, no privileges or user interaction required, and limited impact on integrity.
Mitigation Recommendations
No official patch or remediation level has been confirmed as of the published date. Users should monitor the vendor's advisory channels for updates and apply any official fixes once available. Until then, avoid processing untrusted XSPF playlists or restrict access to MPD services to trusted users to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-05-27T17:40:12.738Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a189d28e29bf47b50227a7c
Added to database: 5/28/2026, 7:53:12 PM
Last enriched: 5/28/2026, 7:54:31 PM
Last updated: 5/29/2026, 5:33:37 PM
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.