Read the docs
TI-2026-37976 Aliases CVE-2026-52877

Streambert : Insecure Protocol Execution in open-external IPC Handler

Priority HIGH 75CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal without validating its protocol. A compromised renderer can submit file: URIs or operating-system-specific custom schemes, causing the host to open local files, access remote resources through registered handlers, or launch scripts and applications supported by those handlers. This issue is fixed in version 2.6.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00407 35th percentileScored 2026-11-07
Fix Fixed streambert (truelockmc): 2.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
truelockmcstreambertbefore 2.6.02.6.0Patch availableCNA
  • streambert Vendortruelockmc Affected before 2.6.0 Fixed in 2.6.0 Patch available CNA

Remediation

  • Fix · CNA streambert (truelockmc) Fixed in 2.6.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-52877

References

Other 3

  • TI-2026-35498 Streambert Vulnerable to Arbitrary Binary Execution via Downloader IPC Handler CVSS 3.1CRITICAL 10.0
  • TI-2026-35497 Streambert: Arbitrary File Write (Zip Slip) via Subtitle Extraction CVSS 3.1CRITICAL 10.0
  • TI-2026-35488 Streambert Vulnerable to Remote Code Execution (RCE) via Unvalidated Auto-Updater IPC Handler CVSS 4.0CRITICAL 9.3
  • TI-2026-37974 Streambert: Arbitrary Directory Creation and File Manipulation via Backup Handler CVSS 4.0HIGH 8.4
  • TI-2026-37972 Streambert: Local File Exfiltration and Overwrite via Subtitle file: Protocol CVSS 3.1HIGH 8.8
  • TI-2026-37973 Streambert: Global CSP Removal in Wyzie Redeem Window Enables Unconstrained XSS in Electron Renderer CVSS 3.1MEDIUM 6.9
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences