CVE-2026-44482

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44482", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-06T17:18:51.783Z", "datePublished": "2026-05-14T14:51:37.557Z", "dateUpdated": "2026-05-14T17:58:22.744Z"}, "containers": {"cna": {"title": "soundcloud-rpc: Remote Code Execution via XSS in Track Title", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/richardhbtz/soundcloud-rpc/security/advisories/GHSA-p37x-32p8-445f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/richardhbtz/soundcloud-rpc/security/advisories/GHSA-p37x-32p8-445f"}], "affected": [{"vendor": "richardhbtz", "product": "soundcloud-rpc", "versions": [{"version": "< 0.1.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-14T14:51:37.557Z"}, "descriptions": [{"lang": "en", "value": "soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock support. Prior to 0.1.8, a track title containing an HTML payload executed locally in the Electron app. This means attacker-controlled SoundCloud track metadata can lead to local command execution on the user's machine. The application exposes a preload API (window.soundcloudAPI.sendTrackUpdate) to the remote SoundCloud page. Track metadata from SoundCloud is trusted and forwarded through IPC into the Electron main process. The app later renders that metadata as raw HTML inside privileged Electron views that have Node.js integration enabled. This vulnerability is fixed in 0.1.8."}], "source": {"advisory": "GHSA-p37x-32p8-445f", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/richardhbtz/soundcloud-rpc/security/advisories/GHSA-p37x-32p8-445f", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-14T17:58:19.349908Z", "id": "CVE-2026-44482", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T17:58:22.744Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44482", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-14T17:58:19.349908Z"}}}], "references": [{"url": "https://github.com/richardhbtz/soundcloud-rpc/security/advisories/GHSA-p37x-32p8-445f", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T17:58:13.294Z"}}], "cna": {"title": "soundcloud-rpc: Remote Code Execution via XSS in Track Title", "source": {"advisory": "GHSA-p37x-32p8-445f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "richardhbtz", "product": "soundcloud-rpc", "versions": [{"status": "affected", "version": "< 0.1.8"}]}], "references": [{"url": "https://github.com/richardhbtz/soundcloud-rpc/security/advisories/GHSA-p37x-32p8-445f", "name": "https://github.com/richardhbtz/soundcloud-rpc/security/advisories/GHSA-p37x-32p8-445f", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock support. Prior to 0.1.8, a track title containing an HTML payload executed locally in the Electron app. This means attacker-controlled SoundCloud track metadata can lead to local command execution on the user's machine. The application exposes a preload API (window.soundcloudAPI.sendTrackUpdate) to the remote SoundCloud page. Track metadata from SoundCloud is trusted and forwarded through IPC into the Electron main process. The app later renders that metadata as raw HTML inside privileged Electron views that have Node.js integration enabled. This vulnerability is fixed in 0.1.8."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-14T14:51:37.557Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44482", "state": "PUBLISHED", "dateUpdated": "2026-05-14T17:58:22.744Z", "dateReserved": "2026-05-06T17:18:51.783Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-14T14:51:37.557Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "soundcloud-rpc", "vendor": "richardhbtz", "versions": [{"status": "affected", "version": "< 0.1.8"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock support. Prior to 0.1.8, a track title containing an HTML payload executed locally in the Electron app. This means attacker-controlled SoundCloud track metadata can lead to local command execution on the user's machine. The application exposes a preload API (window.soundcloudAPI.sendTrackUpdate) to the remote SoundCloud page. Track metadata from SoundCloud is trusted and forwarded through IPC into the Electron main process. The app later renders that metadata as raw HTML inside privileged Electron views that have Node.js integration enabled. This vulnerability is fixed in 0.1.8."}, {"lang": "es", "value": "soundcloud-rpc es un Cliente de SoundCloud con soporte para Discord Rich Presence, Modo Oscuro, Last.fm y AdBlock. Antes de la versi\u00f3n 0.1.8, el t\u00edtulo de una pista que conten\u00eda una carga \u00fatil HTML se ejecutaba localmente en la aplicaci\u00f3n Electron. Esto significa que los metadatos de las pistas de SoundCloud controlados por el atacante pueden llevar a la ejecuci\u00f3n local de comandos en la m\u00e1quina del usuario. La aplicaci\u00f3n expone una API de precarga (window.soundcloudAPI.sendTrackUpdate) a la p\u00e1gina remota de SoundCloud. Los metadatos de las pistas de SoundCloud son de confianza y se reenv\u00edan a trav\u00e9s de IPC al proceso principal de Electron. La aplicaci\u00f3n luego renderiza esos metadatos como HTML sin procesar dentro de vistas privilegiadas de Electron que tienen la integraci\u00f3n de Node.js habilitada. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 0.1.8."}], "id": "CVE-2026-44482", "lastModified": "2026-10-26T14:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44482", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-14T17:58:19.349908Z", "version": "2.0.3"}}]}, "published": "2026-05-14T15:16:48.793", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/richardhbtz/soundcloud-rpc/security/advisories/GHSA-p37x-32p8-445f"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/richardhbtz/soundcloud-rpc/security/advisories/GHSA-p37x-32p8-445f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.1.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "soundcloud-rpc", "source": "cna", "vendor": "richardhbtz"}, "product": "soundcloud-rpc", "vendor": "richardhbtz"}], "created": "2026-05-14T16:30:24.544588+00:00", "updated": "2026-05-15T11:21:17.461319+00:00", "vendors": ["richardhbtz", "richardhbtz$PRODUCT$soundcloud-rpc"]}