# CVE-2026-49130: Music Player Daemon CRLF injection in XSPF playlist plugin

Source: https://junglewise.ai/threats/cve-2026-49130-music-player-daemon-crlf-injection-in-xspf-playlist-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2026-49130 · Severity: medium · CVSS 5.3 · Published 2026-05-28

Music Player Daemon (MPD), a popular service for playing music across networks, is vulnerable to a flaw in how it handles certain playlist files. An attacker can provide a specially crafted playlist that tricks the system into injecting fake information into its internal responses. This can lead to music players displaying incorrect song details, desynchronizing the connection between the player and the server, or potentially misleading users with forged data.

Technologies: [MusicPlayerDaemon Music Player Daemon](https://junglewise.ai/threats/technologies/music-player-daemon). Vendors: [MusicPlayerDaemon](https://junglewise.ai/threats/vendors/musicplayerdaemon).

## Quick answers

**Is CVE-2026-49130 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49130 being exploited in the wild.

**How severe is CVE-2026-49130?** Medium severity, with a CVSS score of 5.3, published 28 May 2026.

**Which products and versions are affected?** MusicPlayerDaemon Music Player Daemon before 0.24.11.

**Is there a fix for CVE-2026-49130?** A patch was published on 2026-05-15: Version 0.24.11 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49130 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-49130?** Check whether you run MusicPlayerDaemon Music Player Daemon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A CRLF injection vulnerability exists in the xspf_char_data function within the XSPF playlist plugin of MPD. The root cause is the improper handling of XML numeric character references (e.g., &#x0A;) which are decoded by the Expat library into literal carriage return and line feed bytes before being passed to the character data callback. Because MPD's wire protocol uses a newline-delimited key-value format, an attacker can supply a malicious XSPF playlist with these encoded characters in the <location> field to inject forged lines into protocol responses such as playlistinfo and currentsong. This can result in protocol desynchronization or the injection of arbitrary metadata. The issue is fixed in version 0.24.11.

## Affected products

- MusicPlayerDaemon Music Player Daemon (MPD) before 0.24.11

## Timeline

- 2026-05-14: disclosed: Issue reported on GitHub
- 2026-05-15: patched: Version 0.24.11 released
- 2026-05-28: advisory: NVD publication date

## References

- [https://github.com/MusicPlayerDaemon/MPD/commit/855085b35c67dddeef0652e2cb3ac8cdd4f457b7](https://github.com/MusicPlayerDaemon/MPD/commit/855085b35c67dddeef0652e2cb3ac8cdd4f457b7)
- [https://github.com/MusicPlayerDaemon/MPD/issues/2483](https://github.com/MusicPlayerDaemon/MPD/issues/2483)
- [https://github.com/MusicPlayerDaemon/MPD/releases/tag/v0.24.11](https://github.com/MusicPlayerDaemon/MPD/releases/tag/v0.24.11)
- [https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24.11/NEWS](https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24.11/NEWS)
- [https://www.musicpd.org/news/2026/05/mpd-0-24-11-released/](https://www.musicpd.org/news/2026/05/mpd-0-24-11-released/)
- [https://www.vulncheck.com/advisories/music-player-daemon-crlf-injection-via-xspfplaylistplugin-cxx](https://www.vulncheck.com/advisories/music-player-daemon-crlf-injection-via-xspfplaylistplugin-cxx)

## Related threats

- [Music Player Daemon path traversal in LocalStorage plugin](https://junglewise.ai/threats/cve-2026-49128-music-player-daemon-path-traversal-in-localstorage-plugin)
- [Music Player Daemon stack buffer overflow in PCM decoder](https://junglewise.ai/threats/cve-2026-49127-music-player-daemon-stack-buffer-overflow-in-pcm-decoder)