CVE-2026-44482

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-44482

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44482.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-44482

Aliases

GHSA-p37x-32p8-445f

Published

2026-05-14T14:51:37.557Z

Modified

2026-07-08T08:13:38.970163420Z

Severity

9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Summary

soundcloud-rpc: Remote Code Execution via XSS in Track Title

Details

soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock support. Prior to 0.1.8, a track title containing an HTML payload executed locally in the Electron app. This means attacker-controlled SoundCloud track metadata can lead to local command execution on the user's machine. The application exposes a preload API (window.soundcloudAPI.sendTrackUpdate) to the remote SoundCloud page. Track metadata from SoundCloud is trusted and forwarded through IPC into the Electron main process. The app later renders that metadata as raw HTML inside privileged Electron views that have Node.js integration enabled. This vulnerability is fixed in 0.1.8.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44482.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-20",
        "CWE-79",
        "CWE-862",
        "CWE-94"
    ]
}

References

Affected packages

Git / github.com/richardhbtz/soundcloud-rpc

Affected ranges

Type

GIT

Repo

https://github.com/richardhbtz/soundcloud-rpc

Events

Introduced

Fixed

f021314398696fd28e3cfa66d49f0a83145fd30e

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.1.8"
        }
    ]
}

Affected versions

0.*

0.0.2

0.0.3

0.0.4

0.0.5

0.0.6

0.0.7

0.0.8

v0.*

v0.0.8

v0.0.9

v0.1.0

v0.1.1

v0.1.2

v0.1.3

v0.1.4

v0.1.5

v0.1.6

v0.1.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44482.json"