Cross-Platform Electron Desktop App Vulnerability in Streambert
CVE-2026-52877

8.3HIGH

Key Information:

Vendor

Truelockmc

Status
Streambert
Vendor
CVE Published:
18 August 2026

What is CVE-2026-52877?

Streambert, a cross-platform Electron Desktop App for streaming and downloading video content, harbors a significant vulnerability in its IPC handler. Before version 2.6.0, the application incorrectly allows renderer-supplied URLs to be passed directly to Electron's shell.openExternal method without proper validation. This oversight can be exploited by a compromised renderer, enabling the execution of file: URIs or custom operating-system-specific schemes. As a result, attackers could potentially manipulate the host system by opening local files, accessing unauthorized remote resources through registered handlers, or executing scripts and applications linked to these handlers. Users are urged to update to version 2.6.0 or later to mitigate this risk.

Affected Version(s)

streambert < 2.6.0

References

https://github.com/truelockmc/streambert/security/advisor...
x_refsource_CONFIRM
https://github.com/truelockmc/streambert/commit/8fd7eb1d3...
x_refsource_MISC
https://github.com/truelockmc/streambert/releases/tag/2.6.0
x_refsource_MISC

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.