Does dBpoweramp use Javascript from a remote website/server when

* Downloading metadata?
* Searching the Internet for additional album art?

The issue is would running such Javascript allow for a Spectre Variant 2 (CVE-2017-5715) attack? This attack requires processors...