---
id: CVE-2026-52876
title: >-
  Streambert is a cross-platform Electron Desktop App to stream and download
  video content
summary: >-
  Streambert is a cross-platform Electron Desktop App to stream and download
  video content. Prior to version 2.6.0, the open-path-at-time IPC handler in
  src/ipc/player.js accepts a renderer-controlled filePath without validating
  its type o…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cwe:
  - CWE-20
  - CWE-78
published: '2026-08-18'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:13:25.910'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-52876'
references:
  - url: >-
      https://github.com/truelockmc/streambert/commit/43566ed031183b046675761c9813c5379b619269
    label: security-advisories@github.com
  - url: 'https://github.com/truelockmc/streambert/pull/149'
    label: security-advisories@github.com
  - url: 'https://github.com/truelockmc/streambert/releases/tag/2.6.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/truelockmc/streambert/security/advisories/GHSA-85vf-2qwc-qpm4
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00153
epssPercentile: 0.04783
ingestedAt: '2026-09-09T21:22:45.538Z'
---

## Overview

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or fail, the handler passes filePath to Electron's shell.openPath. A compromised renderer can provide the path of a local executable, script, shortcut, or other file with an executing default handler, causing the operating system to launch it with the privileges of the StreamBERT process and enabling escape from the renderer sandbox. This issue is fixed in version 2.6.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.