CVE-2026-49130 is a CRLF injection vulnerability in Music Player Daemon (MPD) prior to version 0.24.11. The vulnerability exists in the xspf_char_data function of the XSPF playlist plugin, where attackers can embed literal CR/LF bytes in URI fields by supplying malicious XSPF playlists containing XML numeric character references. This allows injection of forged key-value lines into MPD protocol responses and the state file writer due to Expat's decoding behavior. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level.

Successful exploitation allows an attacker to inject forged key-value lines into MPD protocol responses and state files, potentially leading to manipulation of playlist information and other protocol outputs. This could cause confusion or misinterpretation of MPD responses by clients or scripts relying on these outputs. No direct privilege escalation or remote code execution is indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted XSPF playlists or restrict playlist sources to trusted inputs to mitigate exploitation risk.