CVE-2026-44482

{
  "id": "CVE-2026-44482",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-14T15:16:48.793",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock support. Prior to 0.1.8, a track title containing an HTML payload executed locally in the Electron app. This means attacker-controlled SoundCloud track metadata can lead to local command execution on the user's machine. The application exposes a preload API (window.soundcloudAPI.sendTrackUpdate) to the remote SoundCloud page. Track metadata from SoundCloud is trusted and forwarded through IPC into the Electron main process. The app later renders that metadata as raw HTML inside privileged Electron views that have Node.js integration enabled. This vulnerability is fixed in 0.1.8."
    },
    {
      "lang": "es",
      "value": "soundcloud-rpc es un Cliente de SoundCloud con soporte para Discord Rich Presence, Modo Oscuro, Last.fm y AdBlock. Antes de la versión 0.1.8, el título de una pista que contenía una carga útil HTML se ejecutaba localmente en la aplicación Electron. Esto significa que los metadatos de las pistas de SoundCloud controlados por el atacante pueden llevar a la ejecución local de comandos en la máquina del usuario. La aplicación expone una API de precarga (window.soundcloudAPI.sendTrackUpdate) a la página remota de SoundCloud. Los metadatos de las pistas de SoundCloud son de confianza y se reenvían a través de IPC al proceso principal de Electron. La aplicación luego renderiza esos metadatos como HTML sin procesar dentro de vistas privilegiadas de Electron que tienen la integración de Node.js habilitada. Esta vulnerabilidad se corrigió en la versión 0.1.8."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "richardhbtz",
          "product": "soundcloud-rpc",
          "versions": [
            {
              "version": "< 0.1.8",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-14T17:58:19.349908Z",
          "id": "CVE-2026-44482",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/richardhbtz/soundcloud-rpc/security/advisories/GHSA-p37x-32p8-445f",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/richardhbtz/soundcloud-rpc/security/advisories/GHSA-p37x-32p8-445f",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}