Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2023-36177: Snapcast Arbitrary Code Execution and Data Exposure
CVE-2023-36177 · published 2 years ago
Summary
A remote attacker can execute malicious code and access sensitive information through a specially crafted request to Snapcast's JSON-RPC API. This is a significant security risk because it could allow unauthorized access to your system. To protect your system, ensure you keep your Snapcast software up to date with the latest version.
What to do
- Update debian snapcast to version 0.26.0+dfsg1-1+deb12u1.
- Update debian snapcast to version 0.30.0-1.
- Update canonical snapcast to version 0.18.1-1ubuntu0.1~esm1.
- Update canonical snapcast to version 0.25.0+dfsg1-2ubuntu0.1~esm1.
- Update canonical snapcast to version 0.27.0+dfsg-1ubuntu0.1~esm1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | snapcast |
< 0.26.0+dfsg1-1+deb12u1 Fix: upgrade to 0.26.0+dfsg1-1+deb12u1
|
| Debian:13 | debian | snapcast |
< 0.30.0-1 Fix: upgrade to 0.30.0-1
|
| Debian:14 | debian | snapcast |
< 0.30.0-1 Fix: upgrade to 0.30.0-1
|
| Ubuntu:Pro:20.04:LTS | canonical | snapcast |
< 0.18.1-1ubuntu0.1~esm1 Fix: upgrade to 0.18.1-1ubuntu0.1~esm1
|
| Ubuntu:Pro:22.04:LTS | canonical | snapcast |
< 0.25.0+dfsg1-2ubuntu0.1~esm1 Fix: upgrade to 0.25.0+dfsg1-2ubuntu0.1~esm1
|
| Ubuntu:Pro:24.04:LTS | canonical | snapcast |
< 0.27.0+dfsg-1ubuntu0.1~esm1 Fix: upgrade to 0.27.0+dfsg-1ubuntu0.1~esm1
|
| – | badaix | snapcast |
<= 0.27.0 cpe:2.3:a:badaix:snapcast:*:*:*:*:*:*:*:* |
Original advisory text
An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request in JSON-RPC-API.
An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request in JSON-RPC-API.
References
- https://oxnan.com/posts/Snapcast_jsonrpc_rce URL
- https://security-tracker.debian.org/tracker/CVE-2023-36177 Vendor Advisory
- https://ubuntu.com/security/CVE-2023-36177 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-36177 Third Party Advisory
- https://ubuntu.com/security/notices/USN-8767-1 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36177... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-36177 Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2025/07/msg00015.html URL
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-94Code Injection
Timeline
Published23 Jan 2024
Updated21 Oct 2026
First seen9 Jul 2026
Sources
CVE-2023-36177 · NVD
CVE-2023-36177 · MITRE
DEBIAN-CVE-2023-36177 · OSV
UBUNTU-CVE-2023-36177 · OSV
CVE-2023-36177 · OSV
Track software like this
Free during beta