CVE-2026-52877

Received Received - Intake

Electron App Remote Code Execution via Unsafe openExternal in Streambert

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal without validating its protocol. A compromised renderer can submit file: URIs or operating-system-specific custom schemes, causing the host to open local files, access remote resources through registered handlers, or launch scripts and applications supported by those handlers. This issue is fixed in version 2.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-52877

Affected Vendors & Products

Vendor	Product	Version / Range
streambert	streambert	2.6.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-749	The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Streambert versions prior to 2.6.0. The app's open-external IPC handler in src/ipc/downloads.js accepts a URL from the renderer process without checking its protocol. This allows a compromised renderer to send file: URIs or custom schemes, which the host system may process unsafely.

Detection Guidance

To detect this vulnerability, check if you are running Streambert versions prior to 2.6.0. Inspect the application's version and update it if necessary. No specific commands are provided for detection beyond version verification.

Impact Analysis

An attacker could exploit this to open local files, access remote resources via registered handlers, or launch scripts/applications on your system. This could lead to data theft, malware execution, or unauthorized system access depending on your environment.

Compliance Impact

This vulnerability could potentially violate compliance with standards like GDPR or HIPAA by allowing unauthorized local file access or execution of scripts through malicious file: URIs or custom schemes. Unvalidated external URL handling may lead to data exfiltration or unauthorized system access, which are critical risks under these regulations.

Mitigation Strategies

Immediately update Streambert to version 2.6.0 or later to address the vulnerability. Avoid using untrusted sources or modified versions of the application.

Hi! I’m here to help you understand CVE-2026-52877. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70