Read the docs
TI-2026-37973 Aliases CVE-2026-52873

Streambert: Global CSP Removal in Wyzie Redeem Window Enables Unconstrained XSS in Electron Renderer

Priority MEDIUM 64CWE-693Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Security bypass, Cross-site scripting
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-693 and CWE-79.

Summary

Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC handler in index.js creates the partition:wyzie-redeem Electron session and registers an onHeadersReceived hook that removes the Content-Security-Policy header from every response in that session. The redeem window also lacks a setWindowOpenHandler restriction, so script injection in sub.wyzie.io, a loaded third-party resource, or a site reached through navigation executes without CSP constraints and can affect additional windows and persistent session storage. A user must open the Wyzie API key redemption window, and exploitation requires attacker-controlled script content in a loaded page. The resulting renderer script can invoke renderer-exposed application functionality and can be chained with other vulnerabilities to access internal services or sensitive data. This issue is fixed in version 2.6.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00359 29th percentileScored 2026-11-07
Fix Fixed streambert (truelockmc): 2.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
truelockmcstreambertbefore 2.6.02.6.0Patch availableCNA
  • streambert Vendortruelockmc Affected before 2.6.0 Fixed in 2.6.0 Patch available CNA

Remediation

  • Fix · CNA streambert (truelockmc) Fixed in 2.6.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-52873

References

Other 4

  • TI-2026-35498 Streambert Vulnerable to Arbitrary Binary Execution via Downloader IPC Handler CVSS 3.1CRITICAL 10.0
  • TI-2026-35497 Streambert: Arbitrary File Write (Zip Slip) via Subtitle Extraction CVSS 3.1CRITICAL 10.0
  • TI-2026-35488 Streambert Vulnerable to Remote Code Execution (RCE) via Unvalidated Auto-Updater IPC Handler CVSS 4.0CRITICAL 9.3
  • TI-2026-37974 Streambert: Arbitrary Directory Creation and File Manipulation via Backup Handler CVSS 4.0HIGH 8.4
  • TI-2026-37976 Streambert : Insecure Protocol Execution in open-external IPC Handler CVSS 3.1HIGH 8.3
  • TI-2026-37972 Streambert: Local File Exfiltration and Overwrite via Subtitle file: Protocol CVSS 3.1HIGH 8.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences