CVE-2026-52876

Received Received - Intake

Path Traversal in StreamBERT Electron App

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or fail, the handler passes filePath to Electron's shell.openPath. A compromised renderer can provide the path of a local executable, script, shortcut, or other file with an executing default handler, causing the operating system to launch it with the privileges of the StreamBERT process and enabling escape from the renderer sandbox. This issue is fixed in version 2.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-52876

Affected Vendors & Products

Vendor	Product	Version / Range
streambert	streambert	to 2.6.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability exists in StreamBERT versions before 2.6.0. It involves an IPC handler that accepts a file path from the renderer without proper validation. If media player launch fails, the path is passed to Electron's shell.openPath, which can execute local files like executables or scripts with StreamBERT's privileges, bypassing the renderer sandbox.

Detection Guidance

To detect this vulnerability, check if you are running a version of StreamBERT prior to 2.6.0. Use commands like 'npm list streambert' or check the application version in settings. Inspect Electron app logs for suspicious IPC handler activity involving filePath parameters.

Impact Analysis

An attacker could exploit this to run malicious files on your system with the same permissions as StreamBERT. This could allow installation of malware, data theft, or further system compromise depending on your user privileges.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized code execution on a user's system. If exploited, it may allow attackers to run arbitrary executables with the privileges of the StreamBERT process, which could lead to data exfiltration or unauthorized access to sensitive information. This could violate data protection requirements under GDPR and HIPAA if personal or health data is compromised.

Mitigation Strategies

Immediately update StreamBERT to version 2.6.0 or later. If updating is not possible, restrict file execution permissions on the system and disable default handlers for executable files. Monitor for unusual process launches by the StreamBERT application.

Hi! I’m here to help you understand CVE-2026-52876. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70