CVE-2026-49130: Music Player Daemon CRLF Injection in XSPF Playlists

Technical summary

The vulnerability resides in the xspf_char_data function of MPD's XSPF playlist plugin. It stems from a CRLF injection opportunity where the Expat XML parser decodes numeric character references (e.g., 
 for carriage return, 
 for line feed) before passing data to the character data callback. The plugin fails to sanitize or validate URI field content, allowing attackers to embed literal CR/LF bytes that break out of the intended URI context. These injected bytes can corrupt MPD protocol responses (playlistinfo, currentsong, listplaylist commands) and the state file, enabling header injection or protocol-level manipulation.

Business impact

The risk here is primarily integrity-focused. An attacker positioned to serve malicious playlists to MPD instances could inject fake data into protocol responses, potentially leading to cache poisoning of MPD client state, confusion in music playback tracking, or injection of misleading information into logs and state files. This is most concerning in environments where MPD responses feed into automated systems, monitoring dashboards, or scripts that parse output without strict validation. Direct confidentiality or availability impact is unlikely under typical deployment scenarios.

Affected systems

Music Player Daemon (MPD) versions prior to 0.24.11 are vulnerable. All deployments loading and processing XSPF playlists are at risk, including headless media server setups, containerized music services, and distributed playback systems. Any client or service that trusts MPD's protocol output without deep validation could be affected by injected content.

Exploitability

Exploitability is straightforward: an attacker needs only to craft a malicious XSPF playlist file and have it loaded by a vulnerable MPD instance. No authentication or special privileges are required. The barrier to exploitation is low—crafting an XSPF file with XML numeric character references is trivial. However, the attacker must have a means to deliver the playlist (e.g., hosting a playlist URL that MPD loads, or placing a file on a shared filesystem). The attack does not require user interaction in the technical sense, but it does depend on MPD actually processing a playlist under attacker control.

Remediation

Upgrade Music Player Daemon to version 0.24.11 or later. The patch addresses the vulnerability by properly sanitizing character data in the XSPF plugin to prevent CRLF injection. After patching, audit any playlists that may have been processed by vulnerable versions and review any downstream systems that consume MPD output for signs of injected content or protocol anomalies.

Patch guidance

Update MPD to version 0.24.11 or later. Verify availability through your distribution's package manager (most Linux distributions maintain MPD packages) or build from the official MPD repository. Before updating, document current MPD configuration and playlists for post-patch validation. Test the update in a non-production environment first to ensure compatibility with your playback clients and automation scripts. Restart the MPD daemon after patching.

Detection guidance

Monitor MPD protocol responses and state files for unexpected CR/LF sequences or protocol-level artifacts (e.g., lines beginning with special characters or unintended command-like strings in song metadata or URIs). Check access logs and playlist load events around the time of suspicious MPD behavior. Examine any XSPF playlists loaded from untrusted or external sources for numeric character references in URI or metadata fields, particularly 
, 
, 
, or 
. Consider adding input validation in client applications that parse MPD responses.

Why prioritize this

While this vulnerability carries a CVSS score of 5.3 (Medium), it should not be dismissed as low-priority. It is a clean, network-exploitable integrity issue with no authentication requirement and trivial payload construction. Organizations with exposed or network-accessible MPD instances, or those using MPD in media pipeline automation, should prioritize patching to prevent cache poisoning and protocol injection attacks. Conversely, isolated, local-use MPD instances face minimal real-world risk.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a Medium severity rating: the attack vector is network-based with low complexity, requires no privileges or user interaction, and has no impact on confidentiality or availability. However, integrity is compromised, allowing injection of forged data into protocol responses and files. The score appropriately captures the technical exploitability but may understate risk in environments where MPD output drives critical automation or feeds into downstream monitoring systems.

Frequently asked questions