CVE-2026-50235 is a reflected cross-site scripting vulnerability in LMS Community's Lyrion Music Server version 9.2.0. The issue occurs in the advanced search functionality where user-supplied input is not properly neutralized before being included in the web page output. This improper input handling allows attackers to inject and execute arbitrary JavaScript code in the context of the victim's browser session. The vulnerability has a CVSS 4.0 score of 5.1, reflecting a medium severity level with network attack vector, low complexity, no privileges required, and requiring user interaction.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript in the context of the victim's browser when they interact with manipulated search parameters. This can lead to theft of session cookies or other sensitive information accessible via the browser, potentially enabling session hijacking or other client-side attacks. However, the vulnerability requires user interaction and does not grant direct system-level access.

No official patch or remediation guidance is currently available from the vendor. Since the product is not a cloud service, users should monitor the vendor's advisory channels for updates or patches addressing this vulnerability. Until a fix is released, users should exercise caution when interacting with search parameters and consider implementing web application firewall (WAF) rules to detect and block suspicious input patterns related to XSS. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.