CVE-2026-52877

HIGH 8.3

Streambert : Insecure Protocol Execution in open-external IPC Handler

CVSS Score

8.3

EPSS Score

0.0%

EPSS Percentile

0th

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal without validating its protocol. A compromised renderer can submit file: URIs or operating-system-specific custom schemes, causing the host to open local files, access remote resources through registered handlers, or launch scripts and applications supported by those handlers. This issue is fixed in version 2.6.0.

CWE	CWE-20 CWE-749
Vendor	truelockmc
Product	streambert
Published	Aug 18, 2026

Stay Ahead of the Next One

Get instant alerts for truelockmc streambert

Be the first to know when new high vulnerabilities affecting truelockmc streambert are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Affected Versions

truelockmc / streambert

< 2.6.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/truelockmc/streambert/security/advisories/GHSA-j2vw-gg3g-wwqr github.com: https://github.com/truelockmc/streambert/commit/8fd7eb1d358d1d69e57e51ddfa71b066b44ff616 github.com: https://github.com/truelockmc/streambert/releases/tag/2.6.0