The vulnerability in soundcloud-rpc allows attacker-controlled SoundCloud track titles containing HTML payloads to be executed locally within the Electron application. Because the app forwards untrusted track metadata through its IPC system and renders it as raw HTML in privileged Electron views that have Node.js integration enabled, an attacker can execute arbitrary commands on the user's machine. The flaw is a classic cross‑site scripting (XSS) that escalates to full local code execution and is underpinned by input validation, authority, and code injection weaknesses (CWE‑20, CWE‑79, CWE‑862, CWE‑94).

The affected product is the soundcloud-rpc client developed by Richard H. Btz. Versions prior to 0.1.8 are vulnerable because they render the track title metadata directly in privileged Electron views. The 0.1.8 release and later versions incorporate the fix that sanitizes the metadata before rendering.

The CVSS score of 9.6 indicates a critical level of severity with potential for complete compromise of the victim’s machine. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector requires an attacker to host a malicious track on SoundCloud and entice a user to play it, at which point the untrusted metadata is rendered and executed. Although no public exploits have been documented, the high severity and the straightforward exploitation path warrant immediate attention.