CVE-2026-50231 is a stored cross-site scripting vulnerability in Lyrion Music Server 9.2.0 affecting the log viewer component. It allows unauthenticated attackers to inject malicious scripts by exploiting unescaped template variables in the web interface. Injection points include search, lines, and path query parameters, as well as values that get logged such as URLs, User-Agent headers, stream titles, and player names. Successful exploitation can lead to arbitrary script execution in the context of users' browsers viewing the logs. The vulnerability has a medium severity CVSS 4.0 score of 5.1. No patch or official remediation is currently documented, and the product is not a cloud service, so remediation depends on vendor updates.

The vulnerability enables unauthenticated attackers to execute arbitrary scripts in the browsers of users who view the affected log viewer interface. This can lead to typical XSS impacts such as session hijacking, defacement, or redirection to malicious sites. However, the CVSS score and description indicate limited impact scope and no direct privilege escalation or system compromise. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently documented, users should exercise caution when accessing the log viewer and consider restricting access to trusted users only. Monitoring vendor communications for updates or patches is recommended.