CVE-2026-44482soundcloud-rpc: Remote Code Execution via XSS in Track Title
Updated under an hour ago ()
Does this affect you?
It affects richardhbtz soundcloud-rpc. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock support. Prior to 0.1.8, a track title containing an HTML payload executed locally in the Electron app. This means attacker-controlled SoundCloud track metadata can lead to local command execution on the user's machine. The application exposes a preload API (window.soundcloudAPI.sendTrackUpdate) to the remote SoundCloud page. Track metadata from SoundCloud is trusted and forwarded through IPC into the Electron main process. The app later renders that metadata as raw HTML inside privileged Electron views that have Node.js integration enabled. This vulnerability is fixed in 0.1.8.
- CVSS
- 9.6 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- Weakness (CWE)
- CWE-20, CWE-79, CWE-94, CWE-862
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Deferred
- Record last updated
- May 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
richardhbtz soundcloud-rpc richardhbtz:soundcloud_rpc (from the name) | before 0.1.8 | CNA record |
References
- https://github.com/richardhbtz/soundcloud-rpc/security/advisories/GHSA-p37x-32p8-445fx-refsource-confirm
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.