CVE Intelligence
Analysis AI-assisted

CVE-2026-44482: soundcloud-rpc: XSS in Track Title Leads to Code Execution in Electron App

soundcloud-rpc versions before 0.1.8 render SoundCloud track titles as raw HTML inside Electron views with Node.js integration enabled, so a crafted title can lead to command execution on the user's machine. The record rates the issue critical with a CVSS 3.1 score of 9.6 and states that it is fixed in 0.1.8. The sources consulted show no confirmed exploitation, and the CVE is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

soundcloud-rpc is a SoundCloud client that adds Discord Rich Presence, Dark Mode, Last.fm and AdBlock support. According to the GitHub advisory, track titles containing HTML were executed inside the Electron app in versions before 0.1.8. The defect sits in how track metadata received from the SoundCloud page is trusted and displayed.

Impact

  • The advisory describes local command execution on the user's machine when attacker-controlled track metadata is processed.
  • The CVSS 3.1 vector in the record scores high impact on confidentiality, integrity and availability, with scope marked as changed and user interaction required.
  • The record also lists the SSVC technical impact as total.

Affected products and versions

  • The affected product is listed as Richardhbtz Soundcloud-rpc, versions below 0.1.8.
  • The record's fixes field is empty, but the description states that the vulnerability is fixed in 0.1.8.

Exploitation status

The CVE is not listed in CISA KEV, and the record does not mention active exploitation. The EPSS probability is 0.00614 with a percentile of 0.48012, dated 2026-10-13. The SSVC exploitation field is none and automatable is no. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Update soundcloud-rpc to version 0.1.8 or later, as stated in the advisory.
  • Until the update is applied, treat the application as untrusted, limit its use, and consider removing it from sensitive systems.
  • Developers of similar Electron apps should avoid rendering untrusted content as HTML and should keep Node.js integration disabled in views that display remote content.

Detection guidance

  • Inventory endpoints for soundcloud-rpc installations and record their versions.
  • Review endpoints running the application for unexpected child processes, unusual file writes or unexpected outbound network activity linked to the app.

Limitations of the available information

  • The record has no structured fixed-version field, and its source status is Deferred.
  • The sources do not describe a proof of concept or public exploit code, so their existence is unknown.
  • The number of installations affected and the exact exploitation conditions beyond the advisory text are unknown.

Frequently asked questions

Which versions of soundcloud-rpc are affected?

The record lists versions below 0.1.8 as affected. The description states that the vulnerability is fixed in 0.1.8.

Is this CVE being exploited in the wild?

The CVE is not listed in CISA KEV, and the sources consulted show no confirmed exploitation. The SSVC exploitation field is none.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.