Stored XSS in Music Server Metadata Tags

Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through media file metadata tags like GENRE, ARTIST, and ALBUM. Attackers can craft files with XSS payloads in metadata tags that execute in the web interface when users view track information or play files, enabling access to management functions and settings disclosure.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability in how it processes media file metadata. Attackers can embed malicious JavaScript payloads within standard ID3 tags—GENRE, ARTIST, and ALBUM fields—that persist in the server's database. When users access the web interface to view track information or play files, these scripts execute in their browsers with the privileges of the authenticated session. This vulnerability matters because it compromises the confidentiality and integrity of user interactions with the music server, potentially exposing administrative functions, settings, and sensitive data. Organizations running Lyrion 9.2.0 for media management are affected, particularly those in environments where multiple users access shared music libraries through web interfaces.

Casky's 301 mapped skills leverage Claude AI's extended reasoning to detect the attack patterns associated with this vulnerability across MITRE ATT&CK's Initial Access (TA0001) and Persistence (TA0043) tactics. Practitioners using Casky would identify suspicious artifact patterns: metadata injection attempts in file upload logs, JavaScript payloads within database records for media fields, and DOM manipulation events originating from user-controlled metadata sources. The platform's skills correlate these findings with CWE-79 (Improper Neutralization of Input During Web Page Generation) signatures, flagging instances where metadata content reaches the browser without sanitization. When analyzing Lyrion servers, practitioners would see detection findings highlighting unescaped metadata rendering, session-based XSS vectors in the web UI, and potential lateral movement indicators where attackers might escalate from stored XSS to administrative access—connecting directly to Initial Access and Persistence objectives in adversary behavior chains.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-50232.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-50232

Casky has 301 skills that investigate the attack patterns behind CVE-2026-50232. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn