Threats affecting pkg:npm/soundcloud-rpc

CVE-2026-44482 is a critical vulnerability in soundcloud-rpc versions prior to 0.1.8. The application improperly validates input from SoundCloud track metadata, allowing an attacker to embed HTML payloads in track titles. This payload executes locally within the Electron app, potentially leading to local command execution due to the rendering of untrusted HTML in privileged views with Node.js integration enabled. The vulnerability arises from trusting and forwarding track metadata through IPC without sanitization. This issue is fixed in version 0.1.8.