What is the CVSS score of EUVD-2026-30300?

EUVD-2026-30300 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of soundcloud-rpc are affected by EUVD-2026-30300?

soundcloud-rpc Electron application versions prior to 0.1.8 contain a critical remote code execution vulnerability that allows attackers to execute arbitrary commands on user systems through…. A patch is available.

How to fix or mitigate EUVD-2026-30300?

Within 24 hours: Identify all systems running soundcloud-rpc and restrict access to the application. Within 7 days: Communicate to affected users that the application must not be used until an update is available; disable or uninstall soundcloud-rpc from managed endpoints if operationally feasible. Within 30 days: Monitor vendor repository for release of version 0.1.8 or later and deploy immediately upon availability; establish a process to prevent installation of versions prior to 0.1.8.

soundcloud-rpc EUVD-2026-30300

| CVE-2026-44482 CRITICAL

Improper Input Validation (CWE-20)

2026-05-14 security-advisories@github.com

Information Disclosure Node.js

9.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 14, 2026 - 16:01 EUVD

Analysis Generated

May 14, 2026 - 15:33 vuln.today

CVE Published

May 14, 2026 - 15:16 nvd

CRITICAL 9.6

DescriptionGitHub Advisory

soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock support. Prior to 0.1.8, a track title containing an HTML payload executed locally in the Electron app. This means attacker-controlled SoundCloud track metadata can lead to local command execution on the user's machine. The application exposes a preload API (window.soundcloudAPI.sendTrackUpdate) to the remote SoundCloud page. Track metadata from SoundCloud is trusted and forwarded through IPC into the Electron main process. The app later renders that metadata as raw HTML inside privileged Electron views that have Node.js integration enabled. This vulnerability is fixed in 0.1.8.

AnalysisAI

Remote code execution in soundcloud-rpc Electron app prior to 0.1.8 allows attackers to execute arbitrary commands on victim machines through maliciously crafted SoundCloud track metadata. When a user plays a SoundCloud track with HTML payload in its title, the application renders the metadata as raw HTML in privileged Electron views with Node.js integration enabled, leading to local command execution. User interaction is required (victim must play the malicious track), but no authentication is needed to upload crafted metadata to SoundCloud. Publicly disclosed via GitHub Security Advisory. EPSS data not available; no CISA KEV listing identified.

Technical ContextAI

soundcloud-rpc is an Electron-based desktop application for SoundCloud playback with Discord integration. The vulnerability stems from improper input validation (CWE-20) in the Electron framework's preload API implementation. The application exposes window.soundcloudAPI.sendTrackUpdate to the remote SoundCloud web page, which forwards track metadata through IPC (Inter-Process Communication) to the Electron main process. The critical flaw is that this metadata is subsequently rendered as raw HTML in Electron BrowserWindow views that have nodeIntegration enabled. Electron's security model requires strict separation between remote content and privileged contexts; enabling nodeIntegration in windows that render untrusted content creates a direct path from web content to operating system command execution. This represents a classic Electron context isolation failure where the boundary between web content and native capabilities was improperly maintained.

RemediationAI

Upgrade to soundcloud-rpc version 0.1.8 or later, which addresses the improper input validation and HTML rendering vulnerability. The fix likely implements context isolation, disables nodeIntegration in windows rendering remote content, or sanitizes track metadata before rendering. Users can obtain the patched release from the project's GitHub releases page at https://github.com/richardhbtz/soundcloud-rpc. If immediate upgrade is not feasible, cease using the application until patched, as no effective workaround exists - the vulnerability is inherent to the application's architecture of rendering untrusted SoundCloud metadata in privileged Electron contexts. Disabling the application would eliminate risk but also remove functionality. Network-level mitigations (firewalls, proxies) are ineffective because the malicious payload arrives through legitimate SoundCloud API traffic. The only compensating control is user awareness: avoid playing tracks from untrusted sources, though determining track trustworthiness is impractical for end users.