Streambert Vulnerable to Remote Code Execution (RCE) via Unvalidated Auto-Updater IPC Handler
Priority HIGH 81CWE-494Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-494.
Summary
Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated auto-updater URL vulnerability that allows a compromised renderer process to make the main process download and execute an arbitrary binary, resulting in remote code execution. Version 2.5.0 contains a patch.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00355 29th percentileScored 2026-11-07
Fix Fixed streambert (truelockmc): 2.5.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| truelockmc | streambert | before 2.5.0 | 2.5.0 | Patch available | CNA |
- streambert Vendortruelockmc Affected before 2.5.0 Fixed in 2.5.0 Patch available CNA
Remediation
- Fix · CNA streambert (truelockmc) Fixed in 2.5.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-48046
References
More truelockmc vulnerabilities
- TI-2026-35498 Streambert Vulnerable to Arbitrary Binary Execution via Downloader IPC Handler CVSS 3.1CRITICAL 10.0
- TI-2026-35497 Streambert: Arbitrary File Write (Zip Slip) via Subtitle Extraction CVSS 3.1CRITICAL 10.0
- TI-2026-37974 Streambert: Arbitrary Directory Creation and File Manipulation via Backup Handler CVSS 4.0HIGH 8.4
- TI-2026-37976 Streambert : Insecure Protocol Execution in open-external IPC Handler CVSS 3.1HIGH 8.3
- TI-2026-37972 Streambert: Local File Exfiltration and Overwrite via Subtitle file: Protocol CVSS 3.1HIGH 8.8
- TI-2026-37973 Streambert: Global CSP Removal in Wyzie Redeem Window Enables Unconstrained XSS in Electron Renderer CVSS 3.1MEDIUM 6.9
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences