CVE-2023-36177

CriticalCVSS 9.8/10Last modified Jul 9, 2026

Description

An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request in JSON-RPC-API.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
badaix	snapcast	0.27.0

References

https://oxnan.com/posts/Snapcast_jsonrpc_rceExploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/07/msg00015.html
https://oxnan.com/posts/Snapcast_jsonrpc_rceExploit, Third Party Advisory

Timeline

Published: Jan 23, 2024
Last modified: Jul 9, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-36186.5A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode funct CVE-2023-361837.8Buffer Overflow vulnerability in OpenImageIO v.2.4.12.0 and before allows a remote to execute arbitrary code and obtain sensitive informatio CVE-2023-361847.5CMysten Labs Sui blockchain v1.2.0 was discovered to contain a stack overflow via the component /spec/openrpc.json.CVE-2023-361879.8Buffer Overflow vulnerability in NETGEAR R6400v2 before version 1.0.4.118, allows remote unauthenticated attackers to execute arbitrary code CVE-2023-361889.8An issue in langchain v.0.0.64 allows a remote attacker to execute arbitrary code via the PALChain parameter in the Python exec method.CVE-2023-361897.5SQL injection vulnerability in langchain before v0.0.247 allows a remote attacker to obtain sensitive information via the SQLDatabaseChain c CVE-2023-36199.8A vulnerability was found in SourceCodester AC Repair and Services System 1.0 and classified as critical. This issue affects some unknown pr CVE-2023-361927.8Sngrep v1.6.0 was discovered to contain a heap buffer overflow via the function capture_ws_check_packet at /src/capture.c.CVE-2023-361937.8Gifsicle v1.9.3 was discovered to contain a heap buffer overflow via the ambiguity_error component at /src/clp.c.CVE-2023-361987.5Buffer Overflow vulnerability in skalenetwork sgxwallet v.1.9.0 allows an attacker to cause a denial of service via the trustedBlsSignMessag CVE-2023-361997.5An issue in skalenetwork sgxwallet v.1.9.0 and below allows an attacker to cause a denial of service via the trustedGenerateEcdsaKey compone CVE-2023-36205.4Cross-site Scripting (XSS) - Stored in GitHub repository amauric/tarteaucitron.js prior to v1.13.1.