CVE-2026-52876: Streambert: Arbitrary File Execution via VLC/mpv Launcher Fallback
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or fail, the handler passes filePath to Electron's shell.openPath. A compromised renderer can provide the path of a local executable, script, shortcut, or other file with an executing default handler, causing the operating system to launch it with the privileges of the StreamBERT process and enabling escape from the renderer sandbox. This issue is fixed in version 2.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Streambertto a version that resolves this vulnerability.Fixed in 2.6.0
Event History
Frequently Asked Questions
Which versions require remediation?
Streambert versions prior to 2.6.0 are affected. The issue is fixed in version 2.6.0.
What level of access is needed to exploit this issue?
An attacker needs control of a Streambert renderer process, such as through a renderer compromise. They can then supply a local path to an executable, script, shortcut, or another file whose default operating-system handler executes it.
Under what conditions does the vulnerable fallback execute a supplied file?
Exploitation depends on the mpv or VLC launch attempts being skipped or failing, which causes Streambert to fall back to Electron's shell.openPath behavior. The launched file runs with the privileges of the Streambert process.
What should administrators do to remediate the issue?
Upgrade to Streambert 2.6.0. The provided information does not specify an alternative mitigation for installations that cannot yet be upgraded.