by Kastro
Paper/Archive/CVE-2025-55204

CVE-2025-55204

staniel359 muffon — muffon has One-click Remote Code Execution via XSS and Custom URL Handling

EPSS 0.7%public exploitCVSS 9.6
critical.is priorityof 100
50
CVSS 9.6 (NVD)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 53.6.536 × 2010.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

muffon is a cross-platform music streaming client for desktop. Versions prior to 2.3.0 have a one-click Remote Code Execution (RCE) vulnerability in. An attacker can exploit this issue by embedding a specially crafted `muffon://` link on any website they control. When a victim visits the site or clicks the link, the browser triggers Muffon’s custom URL handler, causing the application to launch and process the URL. This leads to RCE on the victim's machine without further interaction. Version 2.3.0 patches the issue.

Affected

ProductAffectedFixed inSource
muffon< 2.3.0–CNA

Scores by source

NVD9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
GitHub_M (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/staniel359/muffon/security/advisories/GHSA-gc3f-gqph-522qrefdrive.google.com/file/d/1eCPCQ6leuVM_vecfofFv04c0t9isCBqR/view?usp=sharingrefgithub.com/staniel359/muffon/releases/tag/v2.3.0