Read the docs
TI-2026-37975 Aliases CVE-2026-52876

Streambert: Arbitrary File Execution via VLC/mpv Launcher Fallback

Priority LOW 39CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or fail, the handler passes filePath to Electron's shell.openPath. A compromised renderer can provide the path of a local executable, script, shortcut, or other file with an executing default handler, causing the operating system to launch it with the privileges of the StreamBERT process and enabling escape from the renderer sandbox. This issue is fixed in version 2.6.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.002 9th percentileScored 2026-11-07
Fix Fixed streambert (truelockmc): 2.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
truelockmcstreambertbefore 2.6.02.6.0Patch availableCNA
  • streambert Vendortruelockmc Affected before 2.6.0 Fixed in 2.6.0 Patch available CNA

Remediation

  • Fix · CNA streambert (truelockmc) Fixed in 2.6.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-52876

References

Other 4

  • TI-2026-35498 Streambert Vulnerable to Arbitrary Binary Execution via Downloader IPC Handler CVSS 3.1CRITICAL 10.0
  • TI-2026-35497 Streambert: Arbitrary File Write (Zip Slip) via Subtitle Extraction CVSS 3.1CRITICAL 10.0
  • TI-2026-35488 Streambert Vulnerable to Remote Code Execution (RCE) via Unvalidated Auto-Updater IPC Handler CVSS 4.0CRITICAL 9.3
  • TI-2026-37974 Streambert: Arbitrary Directory Creation and File Manipulation via Backup Handler CVSS 4.0HIGH 8.4
  • TI-2026-37976 Streambert : Insecure Protocol Execution in open-external IPC Handler CVSS 3.1HIGH 8.3
  • TI-2026-37972 Streambert: Local File Exfiltration and Overwrite via Subtitle file: Protocol CVSS 3.1HIGH 8.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences