Skip to content
OpenAdvisories

Package · Alpine

navidrome

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-25578

    Navidrome is vulnerable to XSS via comment from song metadata

    Navidrome is an open source web-based music collection server and streamer. Prior to version 0.60.0, a cross-site scripting vulnerability in the frontend allows a malicious attacker to inject code through the comment metadata of a song to exfiltrate user cred…

    navidrome navidrome github.com/navidrome/navidrome navidrome Alpine Go
  • Medium —
    CVE-2022-23857

    SQL injection in github.com/navidrome/navidrome

    model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains …

    github.com/navidrome/navidrome navidrome Alpine Go