Stored XSS in Lyrion Music Server Log Viewer

Lyrion Music Server 9.2.0 contains an unauthenticated stored cross-site scripting vulnerability in the log viewer that allows attackers to inject malicious scripts by exploiting unescaped template variables. Attackers can inject XSS payloads through search, lines, and path query parameters or by crafting values that get logged such as URLs, User-Agent headers, stream titles, or player names to execute arbitrary scripts in users' browsers.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Lyrion Music Server 9.2.0 suffers from an unauthenticated stored cross-site scripting (XSS) vulnerability in its log viewer component. The vulnerability stems from unescaped template variables that fail to sanitize user-controlled input across multiple attack surfaces—search parameters, query strings, and logged values like URLs, User-Agent headers, stream titles, and player names. Because the vulnerability is stored, malicious payloads persist in the application's logs and execute in the browsers of any user viewing those logs, making this a high-severity issue (CVSS 7.2) that requires no authentication to exploit. Organizations running Lyrion Music Server 9.2.0 are at immediate risk of session hijacking, credential theft, and lateral movement within their networks.

Casky's 301 mapped skills leverage Claude AI with extended reasoning to detect the attack patterns underlying this vulnerability across MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would identify findings showing attackers probing the log viewer endpoint with polyglot XSS payloads injected into search and path parameters—classic reconnaissance behavior. The platform's skills would flag suspicious template variable patterns in HTTP requests and responses, revealing where escaping mechanisms are bypassed. When practitioners examine their findings, they'd see correlated indicators: malformed User-Agent headers containing script tags, stream titles with event handlers, and search queries with JavaScript execution attempts—all converging on the log viewer as the injection point. Casky's extended reasoning would help teams understand the full kill chain: an unauthenticated attacker crafts a malicious stream title or player name, it gets logged, then any user accessing the log viewer automatically executes the attacker's script, enabling credential harvesting or further compromise.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-50231.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-50231

Casky has 301 skills that investigate the attack patterns behind CVE-2026-50231. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn