PT-2026-1311 · Muffon · Muffon

Published 2026-01-05 · Updated 2026-01-07 · CVE-2025-55204

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions muffon versions prior to 2.3.0

Description muffon is a cross-platform music streaming client for desktop. Versions prior to 2.3.0 have a Remote Code Execution (RCE) issue. An attacker can exploit this by embedding a specially crafted muffon:// link on a website they control. When a victim visits the site or clicks the link, the browser triggers Muffon’s custom URL handler, causing the application to launch and process the URL, leading to RCE on the victim's machine without further interaction.

Recommendations Update to version 2.3.0 or later.

Exploit

Fix

RCE

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-55204

GHSA-GC3F-GQPH-522Q

Affected Products

Muffon

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55204.json · Exploit
• 🔥 https://github.com/staniel359/muffon/security/advisories/GHSA-gc3f-gqph-522q · Exploit
• 🔥 https://drive.google.com/file/d/1eCPCQ6leuVM_vecfofFv04c0t9isCBqR/view?usp=sharing · Exploit
• https://osv.dev/vulnerability/CVE-2025-55204 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55204 · Security Note
• https://github.com/staniel359/muffon/releases/tag/v2.3.0 · Note
• https://twitter.com/pulsepatchio/status/2008909902102859786 · Twitter Post
• https://t.me/CVEtracker/41407 · Telegram Post
• https://twitter.com/CVEnew/status/2008236485128986883 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2008269294753153174 · Twitter Post
• https://twitter.com/TheHackerWire/status/2008242336841781619 · Twitter Post