CVE-2025-55204

muffon is a cross-platform music streaming client for desktop. Versions prior to 2.3.0 have a one-click Remote Code Execution (RCE) vulnerability in. An attacker can exploit this issue by embedding a specially crafted `muffon://` link on any website they control. When a victim visits the site or clicks the link, the browser triggers Muffon’s custom URL handler, causing the application to launch and process the URL. This leads to RCE on the victim's machine without further interaction. Version 2.3.0 patches the issue.

• CWE-94
• CWE-79

• https://drive.google.com/file/d/1eCPCQ6leuVM_vecfofFv04c0t9isCBqR/view?usp=sharingExploit
• https://github.com/staniel359/muffon/releases/tag/v2.3.0Product, Release Notes
• https://github.com/staniel359/muffon/security/advisories/GHSA-gc3f-gqph-522qExploit, Third Party Advisory

Published

Jan 5, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-55199Helm is a package manager for Charts for Kubernetes. Prior t…6.5
• CVE-2025-5520A vulnerability was found in Open5GS up to 2.7.3. It has bee…6.9
• CVE-2025-55200BigBlueButton is an open-source virtual classroom. In versio…5.4
• CVE-2025-55201Copier library and CLI app for rendering project templates. …8.5
• CVE-2025-55202Opencast is a free, open-source platform to support the mana…5.3
• CVE-2025-55203Plane is open-source project management software. Prior to v…5.4
• CVE-2025-55205Capsule is a multi-tenancy and policy-based framework for Ku…9
• CVE-2025-55207Astro is a web framework for content-driven websites. Follow…5.5
• CVE-2025-55208Chamilo is a learning management system. Versions prior to 1…9
• CVE-2025-55209contactmanager is a module for FreePBX@, which is an open so…5.1
• CVE-2025-5521A vulnerability was found in WuKongOpenSource WukongCRM 9.0.…8.8
• CVE-2025-55210FreePBX is an open-source web-based graphical user interface…7.5