Is github.com/navidrome/navidrome affected by CVE-2026-25578?

Go github.com/navidrome/navidrome is affected in <0.60.0.

Is CVE-2026-25578 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.3%.

medium

CVE-2026-25578

Q: Is CVE-2026-25578 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.3%.

Go · github.com/navidrome/navidrome

Summary

Navidrome has XSS via comment from song metadata in github.com/navidrome/navidrome

Severity: medium
EPSS: 0.3% (p21)
Also known as: GHSA-rh3r-8pxm-hg4w, GO-2026-4413
Published: 2026-02-05

References

https://github.com/navidrome/navidrome/security/advisories/GHSA-rh3r-8pxm-hg4w
https://github.com/navidrome/navidrome/commit/d7ec7355c9036d5be659d6ac555c334bb5848ba6
https://github.com/navidrome/navidrome/releases/tag/v0.60.0

Related advisories

CVE-2026-25579 — medium · Go/github.com/navidrome/navidrome

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.