CVE-2026-44482

soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock support. Prior to 0.1.8, a track title containing an HTML payload executed locally in the Electron app. This means attacker-controlled SoundCloud track metadata can lead to local command execution on the user's machine. The application exposes a preload API (window.soundcloudAPI.sendTrackUpdate) to the remote SoundCloud page. Track metadata from SoundCloud is trusted and forwarded through IPC into the Electron main process. The app later renders that metadata as raw HTML inside privileged Electron views that have Node.js integration enabled. This vulnerability is fixed in 0.1.8.

• CWE-20
• CWE-79
• CWE-94
• CWE-862

• https://github.com/richardhbtz/soundcloud-rpc/security/advisories/GHSA-p37x-32p8-445f
• https://github.com/richardhbtz/soundcloud-rpc/security/advisories/GHSA-p37x-32p8-445f

Published

May 14, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44474Ella Core is a 5G core designed for private networks. Prior …3.7
• CVE-2026-44475Ella Core is a 5G core designed for private networks. Prior …6.1
• CVE-2026-44477CloudNativePG is a platform designed to manage PostgreSQL da…9.9
• CVE-2026-44478hoppscotch is an open source API development ecosystem. The …7.5
• CVE-2026-44479Vercel’s AI Cloud is a unified platform for building modern …5.5
• CVE-2026-4448Heap buffer overflow in ANGLE in Google Chrome prior to 146.…8.8
• CVE-2026-44483RVF (formerly Remix Validated Form) provides easy form valid…8.2
• CVE-2026-44484PyTorch Lightning is a deep learning framework to pretrain a…9.8
• CVE-2026-44486Axios is a promise based HTTP client for the browser and Nod…7.5
• CVE-2026-44487Axios is a promise based HTTP client for the browser and Nod…7.5
• CVE-2026-44488Axios is a promise based HTTP client for the browser and Nod…7.5
• CVE-2026-44489Axios is a promise based HTTP client for the browser and Nod…5.3