Vulnerability Description
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or fail, the handler passes filePath to Electron's shell.openPath. A compromised renderer can provide the path of a local executable, script, shortcut, or other file with an executing default handler, causing the operating system to launch it with the privileges of the StreamBERT process and enabling escape from the renderer sandbox. This issue is fixed in version 2.6.0.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/truelockmc/streambert/commit/43566ed031183b046675761c9813c537
- https://github.com/truelockmc/streambert/pull/149
- https://github.com/truelockmc/streambert/releases/tag/2.6.0
- https://github.com/truelockmc/streambert/security/advisories/GHSA-85vf-2qwc-qpm4
FAQ
What is CVE-2026-52876?
CVE-2026-52876 is a vulnerability with a CVSS score of 8.8 (HIGH). Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled f...
How severe is CVE-2026-52876?
CVE-2026-52876 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-52876?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.