CVE-2026-52876 PUBLISHED

Streambert: Arbitrary File Execution via VLC/mpv Launcher Fallback

Assigner: GitHub_M
Reserved: 08.06.2026 Published: 18.08.2026 Updated: 18.08.2026

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or fail, the handler passes filePath to Electron's shell.openPath. A compromised renderer can provide the path of a local executable, script, shortcut, or other file with an executing default handler, causing the operating system to launch it with the privileges of the StreamBERT process and enabling escape from the renderer sandbox. This issue is fixed in version 2.6.0.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 8.8

Product Status

Vendor truelockmc
Product streambert
Versions
  • Version < 2.6.0 is affected

References

Problem Types

  • CWE-20: Improper Input Validation CWE
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE