CVE-2026-52877: Streambert : Insecure Protocol Execution in open-external IPC Handler
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal without validating its protocol. A compromised renderer can submit file: URIs or operating-system-specific custom schemes, causing the host to open local files, access remote resources through registered handlers, or launch scripts and applications supported by those handlers. This issue is fixed in version 2.6.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Streambertto a version that resolves this vulnerability.Fixed in 2.6.0
Event History
Frequently Asked Questions
Which deployments are affected?
Streambert installations before version 2.6.0 are affected. The issue is in the desktop application's open-external IPC handler, so systems running the affected application are exposed when a renderer process is compromised.
What does an attacker need to exploit this issue?
An attacker must be able to compromise or control a Streambert renderer process and send a URL to the open-external IPC handler. No user interaction or prior privileges are required according to the supplied severity vector.
What is the recommended remediation?
Update Streambert to version 2.6.0, which fixes the missing protocol validation. If updating cannot happen immediately, reduce exposure by preventing untrusted content or code from compromising the application's renderer processes.