Cross-Platform Electron Desktop App Vulnerability in Streambert by TrueLock

CVE-2026-52873

What is CVE-2026-52873?

The Streambert app, a cross-platform Electron desktop application, suffers from a vulnerability related to its wyzie-open-redeem IPC handler. In versions 2.5.0 to 2.6.0, this handler fails to maintain proper security policies by removing the Content-Security-Policy header from responses in a specific Electron session. Additionally, it lacks restrictions on the setWindowOpenHandler, allowing untrusted script execution in the redeem window through third-party resources like sub.wyzie.io. Exploitability demands user interaction, as users must access the Wyzie API key redemption window, making it possible for attackers to inject malicious scripts that can invoke application functionalities and potentially compromise sensitive data. This vulnerability is remedied in version 2.6.0.

References