This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+8 more
Affected surfaces
ReleasePort's take
Moderate signalThe release fixes an XSS vulnerability in collection filtering and prevents crashes when podcast image URLs change.
Why it matters: Fixes a high‑severity (severity 90) XSS flaw affecting the collection filter UI; mitigates unexpected termination of podcasts on image URL updates, both critical for user security and service stability.
Summary
AI summaryFixed XSS vulnerability in collection filtering and prevented podcats from crashing when updating their image URLs.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Fixes XSS vulnerability when filtering collections with forged tags Fixes XSS vulnerability when filtering collections with forged tags Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Low |
Adds audio acoustic similarity engine using MusicNN embeddings for recommendations Adds audio acoustic similarity engine using MusicNN embeddings for recommendations Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Low |
Allows associating user-provided images to playlists Allows associating user-provided images to playlists Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Low |
Adds `sonicSimilarity` extension support to OpenSubsonic API Adds `sonicSimilarity` extension support to OpenSubsonic API Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Low |
Adds `groupings` field to OpenSubsonic API responses Adds `groupings` field to OpenSubsonic API responses Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Low |
Adds `tokenInfo` endpoint to OpenSubsonic API Adds `tokenInfo` endpoint to OpenSubsonic API Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Low |
Isolates OpenSubsonic API key generation widget and adds copy button Isolates OpenSubsonic API key generation widget and adds copy button Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Feature | Low |
Enhances `.lmsignore` to behave more like `.gitignore` Enhances `.lmsignore` to behave more like `.gitignore` Source: llm_adapter@2026-06-06 Confidence: high |
— |
| Bugfix | Medium |
Prevents unexpected termination when podcast updates its image URL Prevents unexpected termination when podcast updates its image URL Source: llm_adapter@2026-06-06 Confidence: high |
— |
Full changelog
Updates:
- Recommendations can now use a new audio acoustic similarity-based engine (using MusicNN embeddings). The tag-based engine is still the default one, so you have to pick it in the scan settings:
Embedding extraction throughput depends heavily on both the number of scanner threads and the speed of your storage. Typical reported speeds range from ~1k tracks/hour on a Raspberry Pi 4 (3 threads) to ~25k tracks/hour on an Intel Core i5-13500 (10 threads). To speed up extraction, consider tweaking scanner-thread-count in lms.conf (defaults to half the number of logical CPUs) #301
- Associate user-provided images to playlists #833
- Made
.lmsignoremore like.gitignore, seeREADMEfor more details #486 - OpenSubsonic API:
- Added sonicSimilarity extension support #301
- Added the
groupingsfield #846 - Added
tokenInfoendpoint #838 - Isolated the API key generation widget, added a copy button #796
Bugfixes:
- Fixed XSS when filtering collections with a maliciously forged tag #844
- Fixed unexpected termination when a podcast updates its image URL
Security Fixes
- Fixed XSS when filtering collections with a maliciously forged tag #844
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About lms
Lightweight Music Server. Access your self-hosted music using a web interface.
Related context
Related tools
Beta — feedback welcome: [email protected]