CVE-2023-36177

Critical · CVSS 9.8

Snapcast — JSON-RPC API Remote Code Execution (CWE-94 Code Injection)

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: oss containerizable; NVD-CWE-noinfo, CWE-94

Description

An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request in JSON-RPC-API.

Search profile — drives PoC discovery

Symbols JSON-RPC-APIjsonrpcsnapcastbadaixSnapcast::ServerRpcServerjsonrpcppClient.GetStatusServer.GetStatusStream.control

Keywords CVE-2023-36177Snapcast RCESnapcast JSON-RPC exploitbadaix snapcast vulnerabilitySnapcast jsonrpc pocSnapcast 0.27.0 exploitSnapcast remote code executionsnapcast jsonrpc rce

Versions: 0.27.0

Ranked PoCs (1) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

w4zu/Debian_security needs review

trickest

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-05T18:30:39.000Z