Executive brief
Navidrome has XSS via comment from song metadata in github.com/navidrome/navidrome
Affected products
- Go github.com/navidrome/navidrome
Junglewise Threat Intelligence
CVE-2026-25578: GO-2026-4413 - Navidrome has XSS via comment from song metadata in github.com/navidrome/navidrome
CVE-2026-25578 · Severity: low · CVSS 3.1 · Published 2026-02-05
Technologies: github.com/navidrome/navidrome (Go). Vendors: Go.
Related threats
- GO-2026-4411 - Navidrome affected by Denial of Service and disk exhaustion via oversized `size` parameter in `/rest/getCoverArt` and `/share/img/<token>` e
- GO-2025-3734 - Navidrome allows SQL Injection via role parameter in github.com/navidrome/navidrome
- GO-2025-3733 - Navidrome Transcoding Permission Bypass Vulnerability Report in github.com/navidrome/navidrome
- GO-2025-3484 - Navidrome allows an authentication bypass in Subsonic API with non-existent username in github.com/navidrome/navidrome
- GO-2024-3357 - Navidrome Stores JWT Secret in Plaintext in navidrome.db in github.com/navidrome/navidrome