Detections
Analytics

SCA: security update for music-metadata (GHSA-8j4c-6x6g-rq3j)

medium Tenable Cloud Security Plugin ID 473969

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - music-metadata is a metadata parser for audio and video media files. Prior to 11.15.0, the DSF parser
 handles an unrecognized chunk by calling tokenizer.ignore without awaiting the returned promise and
 without first rejecting a chunk size smaller than the 12-byte chunk header. A crafted DSF input can
 produce a negative ignore length; with strtok3 10.3.5 or later, the resulting RangeError is detached from
 the parseBuffer promise and becomes an unhandled rejection under Node.js default behavior. The parse call
 can appear to resolve before the process crashes, bypassing per-parse try/catch handling. The demonstrated
 impact is availability loss only and requires the DSF parsing path. This issue is fixed in version
 11.15.0. (CVE-2026-107392)

Solution

Update the music-metadata library and its related packages to version 11.15.0 or later.

See Also

https://github.com/advisories/GHSA-8j4c-6x6g-rq3j

Plugin Details

Severity: Medium

ID: 473969

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/9/2026

Updated: 10/9/2026

Risk Information

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-107392

CVSS v3

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 5.4

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/8/2026

Vulnerability Publication Date: 10/8/2026

Reference Information

CVE: CVE-2026-107392