CVE-2026-50231 is a stored cross-site scripting vulnerability in Lyrion Music Server 9.2.0 affecting the log viewer component. The vulnerability arises from improper neutralization of input during web page generation, specifically due to unescaped template variables. Attackers can inject XSS payloads through query parameters (search, lines, path) or by submitting values that get logged (e.g., URLs, User-Agent headers, stream titles, player names). This allows execution of arbitrary scripts in the browsers of users viewing the logs. The vulnerability is unauthenticated and does not require user privileges. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation allows attackers to execute arbitrary scripts in the context of the affected users' browsers when they view the log viewer. This can lead to session hijacking, defacement, or other malicious actions within the user's browser session. The vulnerability is unauthenticated and can be triggered remotely via crafted requests or logged values. The CVSS score of 5.1 reflects a medium impact with limited confidentiality, integrity, and availability consequences.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, consider restricting access to the log viewer interface to trusted users only and sanitizing or filtering inputs that may be logged. Avoid exposing the log viewer to untrusted networks or users. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.