Streambert Vulnerable to Arbitrary Binary Execution via Downloader IPC Handler
Priority HIGH 82CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the run-download IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s privileges. Version 2.5.0 contains a patch.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00553 46th percentileScored 2026-11-07
Fix Fixed streambert (truelockmc): 2.5.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| truelockmc | streambert | before 2.5.0 | 2.5.0 | Patch available | CNA |
- streambert Vendortruelockmc Affected before 2.5.0 Fixed in 2.5.0 Patch available CNA
Remediation
- Fix · CNA streambert (truelockmc) Fixed in 2.5.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-48056
References
More truelockmc vulnerabilities
- TI-2026-35497 Streambert: Arbitrary File Write (Zip Slip) via Subtitle Extraction CVSS 3.1CRITICAL 10.0
- TI-2026-35488 Streambert Vulnerable to Remote Code Execution (RCE) via Unvalidated Auto-Updater IPC Handler CVSS 4.0CRITICAL 9.3
- TI-2026-37974 Streambert: Arbitrary Directory Creation and File Manipulation via Backup Handler CVSS 4.0HIGH 8.4
- TI-2026-37976 Streambert : Insecure Protocol Execution in open-external IPC Handler CVSS 3.1HIGH 8.3
- TI-2026-37972 Streambert: Local File Exfiltration and Overwrite via Subtitle file: Protocol CVSS 3.1HIGH 8.8
- TI-2026-37973 Streambert: Global CSP Removal in Wyzie Redeem Window Enables Unconstrained XSS in Electron Renderer CVSS 3.1MEDIUM 6.9
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences