CVE-2026-52876
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Vulnerability in Streambert (before 2.6.0) in the open-path-at-time IPC handler, which passes a renderer-controlled file path to shell.openPath without validation. A compromised renderer can launch a local executable or script.
Risk Assessment
An attacker can execute malicious code with StreamBERT process privileges, enabling escape from the renderer sandbox and system compromise.
Recommendation
Update Streambert to version 2.6.0 or later. Restrict renderer access to file paths.
Original NVD description (English source)
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or fail, the handler passes filePath to Electron's shell.openPath. A compromised renderer can provide the path of a local executable, script, shortcut, or other file with an executing default handler, causing the operating system to launch it with the privileges of the StreamBERT process and enabling escape from the renderer sandbox. This issue is fixed in version 2.6.0.