Cross-Platform Desktop App Vulnerability in Streambert

CVE-2026-52876

What is CVE-2026-52876?

A vulnerability in Streambert, a cross-platform Electron Desktop App, allows a compromised renderer to execute local files due to inadequate validation of the file path provided to the IPC handler. If the mpv or VLC launch attempts are unsuccessful, the handler may pass a hazardous file path to Electron’s shell.openPath without any scrutiny. This flaw can lead to the execution of potentially malicious files with the same privileges as the Streambert process, creating a pathway for attackers to escape the renderer's sandbox. Users are advised to update to version 2.6.0, which addresses this security concern.

References