Executive brief
soundcloud-rpc is a desktop application that integrates SoundCloud with Discord to show what a user is listening to. A security flaw allows an attacker to execute malicious commands on a user's computer simply by having the user play or view a SoundCloud track with a specially crafted title. This could lead to the theft of private files, installation of malware, or full control over the victim's machine.
Technical details
The soundcloud-rpc application is vulnerable to Remote Code Execution (RCE) due to a combination of improper input validation and insecure Electron configurations. The application's preload script (src/preload.ts) exposes the 'window.soundcloudAPI.sendTrackUpdate' API to remote SoundCloud pages, which forwards track metadata via IPC to the main process without validation. The main process then renders this metadata using 'innerHTML' in a BrowserView where 'nodeIntegration' is enabled and 'contextIsolation' is disabled. An attacker can exploit this by uploading a SoundCloud track with a malicious HTML/JavaScript payload in the title; when a victim views or plays this track, the payload executes within a privileged Node.js context, allowing for arbitrary command execution. This issue is fixed in version 0.1.8.
Affected products
- richardhbtz soundcloud-rpc < 0.1.8
Timeline
- 2026-04-30: advisory: Original GitHub security advisory published
- 2026-05-14: disclosed: CVE-2026-44482 published to NVD
- 2026-05-14: patched: Vulnerability fixed in version 0.1.8