CVE-2026-109422 | NetEase Cloud Music 3.1.38/3.1.39.205426 Renderer-Process IPC Bridge cloudmusic.exe os.navigateExternal url os command injection

SecurityVulns
Yanac

A vulnerability labeled as critical has been found in NetEase Cloud Music 3.1.38/3.1.39.205426. This affects the function os.navigateExternal of the file cloudmusic.exe of the component Renderer-Process IPC Bridge. The manipulation of the argument url results in os command injection.

This vulnerability is known as CVE-2026-109422. It is possible to launch the attack remotely. No exploit is available.VulDB Recent EntriesRead More