Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-52877 (GCVE-0-2026-52877)

Vulnerability from nvd – Published: 2026-08-18 21:27 – Updated: 2026-08-18 21:27

Title

Streambert : Insecure Protocol Execution in open-external IPC Handler

Summary

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal without validating its protocol. A compromised renderer can submit file: URIs or operating-system-specific custom schemes, causing the host to open local files, access remote resources through registered handlers, or launch scripts and applications supported by those handlers. This issue is fixed in version 2.6.0.

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

CWE

CWE-20 - Improper Input Validation
CWE-749 - Exposed Dangerous Method or Function

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/truelockmc/streambert/security…	x_refsource_CONFIRM
https://github.com/truelockmc/streambert/commit/8…	x_refsource_MISC
https://github.com/truelockmc/streambert/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
truelockmc	streambert	Affected: < 2.6.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "streambert",
          "vendor": "truelockmc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron\u0027s shell.openExternal without validating its protocol. A compromised renderer can submit file: URIs or operating-system-specific custom schemes, causing the host to open local files, access remote resources through registered handlers, or launch scripts and applications supported by those handlers. This issue is fixed in version 2.6.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-749",
              "description": "CWE-749: Exposed Dangerous Method or Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T21:27:23.802Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/truelockmc/streambert/security/advisories/GHSA-j2vw-gg3g-wwqr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-j2vw-gg3g-wwqr"
        },
        {
          "name": "https://github.com/truelockmc/streambert/commit/8fd7eb1d358d1d69e57e51ddfa71b066b44ff616",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/commit/8fd7eb1d358d1d69e57e51ddfa71b066b44ff616"
        },
        {
          "name": "https://github.com/truelockmc/streambert/releases/tag/2.6.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/releases/tag/2.6.0"
        }
      ],
      "source": {
        "advisory": "GHSA-j2vw-gg3g-wwqr",
        "discovery": "UNKNOWN"
      },
      "title": "Streambert : Insecure Protocol Execution in open-external IPC Handler"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52877",
    "datePublished": "2026-08-18T21:27:23.802Z",
    "dateReserved": "2026-06-08T21:44:27.364Z",
    "dateUpdated": "2026-08-18T21:27:23.802Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52876 (GCVE-0-2026-52876)

Vulnerability from nvd – Published: 2026-08-18 21:29 – Updated: 2026-08-18 21:29

Title

Streambert: Arbitrary File Execution via VLC/mpv Launcher Fallback

Summary

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or fail, the handler passes filePath to Electron's shell.openPath. A compromised renderer can provide the path of a local executable, script, shortcut, or other file with an executing default handler, causing the operating system to launch it with the privileges of the StreamBERT process and enabling escape from the renderer sandbox. This issue is fixed in version 2.6.0.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-20 - Improper Input Validation
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/truelockmc/streambert/security…	x_refsource_CONFIRM
https://github.com/truelockmc/streambert/pull/149	x_refsource_MISC
https://github.com/truelockmc/streambert/commit/4…	x_refsource_MISC
https://github.com/truelockmc/streambert/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
truelockmc	streambert	Affected: < 2.6.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "streambert",
          "vendor": "truelockmc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or fail, the handler passes filePath to Electron\u0027s shell.openPath. A compromised renderer can provide the path of a local executable, script, shortcut, or other file with an executing default handler, causing the operating system to launch it with the privileges of the StreamBERT process and enabling escape from the renderer sandbox. This issue is fixed in version 2.6.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T21:29:08.476Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/truelockmc/streambert/security/advisories/GHSA-85vf-2qwc-qpm4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-85vf-2qwc-qpm4"
        },
        {
          "name": "https://github.com/truelockmc/streambert/pull/149",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/pull/149"
        },
        {
          "name": "https://github.com/truelockmc/streambert/commit/43566ed031183b046675761c9813c5379b619269",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/commit/43566ed031183b046675761c9813c5379b619269"
        },
        {
          "name": "https://github.com/truelockmc/streambert/releases/tag/2.6.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/releases/tag/2.6.0"
        }
      ],
      "source": {
        "advisory": "GHSA-85vf-2qwc-qpm4",
        "discovery": "UNKNOWN"
      },
      "title": "Streambert: Arbitrary File Execution via VLC/mpv Launcher Fallback"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52876",
    "datePublished": "2026-08-18T21:29:08.476Z",
    "dateReserved": "2026-06-08T21:44:27.364Z",
    "dateUpdated": "2026-08-18T21:29:08.476Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52875 (GCVE-0-2026-52875)

Vulnerability from nvd – Published: 2026-08-18 21:30 – Updated: 2026-08-18 21:30

Title

Streambert: Arbitrary Directory Creation and File Manipulation via Backup Handler

Summary

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync, fs.readdirSync, and fs.unlinkSync operations without checking that it is inside an authorized backup location. A compromised renderer can choose an absolute path or a relative traversal path to create directories and write a streambert-backup-[timestamp].json file containing renderer-controlled data. The pruning loop can also delete files in that directory whose names begin with streambert-backup- and end with .json. This vulnerability is fixed in 2.6.0.

Severity

8.4 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73 - External Control of File Name or Path

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/truelockmc/streambert/security…	x_refsource_CONFIRM
https://github.com/truelockmc/streambert/pull/149	x_refsource_MISC
http://github.com/truelockmc/streambert/commit/43…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
truelockmc	streambert	Affected: < 2.6.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "streambert",
          "vendor": "truelockmc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync, fs.readdirSync, and fs.unlinkSync operations without checking that it is inside an authorized backup location. A compromised renderer can choose an absolute path or a relative traversal path to create directories and write a streambert-backup-[timestamp].json file containing renderer-controlled data. The pruning loop can also delete files in that directory whose names begin with streambert-backup- and end with .json. This vulnerability is fixed in 2.6.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73: External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T21:30:48.370Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/truelockmc/streambert/security/advisories/GHSA-c64m-cx97-6rc9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-c64m-cx97-6rc9"
        },
        {
          "name": "https://github.com/truelockmc/streambert/pull/149",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/pull/149"
        },
        {
          "name": "http://github.com/truelockmc/streambert/commit/43566ed031183b046675761c9813c5379b619269",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://github.com/truelockmc/streambert/commit/43566ed031183b046675761c9813c5379b619269"
        }
      ],
      "source": {
        "advisory": "GHSA-c64m-cx97-6rc9",
        "discovery": "UNKNOWN"
      },
      "title": "Streambert: Arbitrary Directory Creation and File Manipulation via Backup Handler"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52875",
    "datePublished": "2026-08-18T21:30:48.370Z",
    "dateReserved": "2026-06-08T21:44:27.364Z",
    "dateUpdated": "2026-08-18T21:30:48.370Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52873 (GCVE-0-2026-52873)

Vulnerability from nvd – Published: 2026-08-18 21:28 – Updated: 2026-08-18 21:28

Title

Streambert: Global CSP Removal in Wyzie Redeem Window Enables Unconstrained XSS in Electron Renderer

Summary

Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC handler in index.js creates the partition:wyzie-redeem Electron session and registers an onHeadersReceived hook that removes the Content-Security-Policy header from every response in that session. The redeem window also lacks a setWindowOpenHandler restriction, so script injection in sub.wyzie.io, a loaded third-party resource, or a site reached through navigation executes without CSP constraints and can affect additional windows and persistent session storage. A user must open the Wyzie API key redemption window, and exploitation requires attacker-controlled script content in a loaded page. The resulting renderer script can invoke renderer-exposed application functionality and can be chained with other vulnerabilities to access internal services or sensitive data. This issue is fixed in version 2.6.0.

Severity

6.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-693 - Protection Mechanism Failure

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/truelockmc/streambert/security…	x_refsource_CONFIRM
https://github.com/truelockmc/streambert/pull/126	x_refsource_MISC
https://github.com/truelockmc/streambert/commit/0…	x_refsource_MISC
https://github.com/truelockmc/streambert/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
truelockmc	streambert	Affected: < 2.6.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "streambert",
          "vendor": "truelockmc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC handler in index.js creates the partition:wyzie-redeem Electron session and registers an onHeadersReceived hook that removes the Content-Security-Policy header from every response in that session. The redeem window also lacks a setWindowOpenHandler restriction, so script injection in sub.wyzie.io, a loaded third-party resource, or a site reached through navigation executes without CSP constraints and can affect additional windows and persistent session storage. A user must open the Wyzie API key redemption window, and exploitation requires attacker-controlled script content in a loaded page. The resulting renderer script can invoke renderer-exposed application functionality and can be chained with other vulnerabilities to access internal services or sensitive data. This issue is fixed in version 2.6.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T21:28:18.806Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/truelockmc/streambert/security/advisories/GHSA-2j2q-qvpf-wh43",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-2j2q-qvpf-wh43"
        },
        {
          "name": "https://github.com/truelockmc/streambert/pull/126",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/pull/126"
        },
        {
          "name": "https://github.com/truelockmc/streambert/commit/0bd6b6ca8c830f22f75de1aa2e0d8b9bdf6d34c7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/commit/0bd6b6ca8c830f22f75de1aa2e0d8b9bdf6d34c7"
        },
        {
          "name": "https://github.com/truelockmc/streambert/releases/tag/2.6.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/releases/tag/2.6.0"
        }
      ],
      "source": {
        "advisory": "GHSA-2j2q-qvpf-wh43",
        "discovery": "UNKNOWN"
      },
      "title": "Streambert: Global CSP Removal in Wyzie Redeem Window Enables Unconstrained XSS in Electron Renderer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52873",
    "datePublished": "2026-08-18T21:28:18.806Z",
    "dateReserved": "2026-06-08T21:44:27.364Z",
    "dateUpdated": "2026-08-18T21:28:18.806Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52872 (GCVE-0-2026-52872)

Vulnerability from nvd – Published: 2026-08-18 21:26 – Updated: 2026-08-18 21:26

Title

Streambert: Local File Exfiltration and Overwrite via Subtitle file: Protocol

Summary

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its decoded pathname to fs.copyFileSync. The renderer also controls downloadPath, which determines the destination path. A compromised renderer can therefore copy any file readable by the StreamBERT process into an attacker-chosen writable location, exposing sensitive local data, and can overwrite existing writable files. This vulnerability is fixed in 2.5.0.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73 - External Control of File Name or Path

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/truelockmc/streambert/security…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
truelockmc	streambert	Affected: < 2.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "streambert",
          "vendor": "truelockmc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its decoded pathname to fs.copyFileSync. The renderer also controls downloadPath, which determines the destination path. A compromised renderer can therefore copy any file readable by the StreamBERT process into an attacker-chosen writable location, exposing sensitive local data, and can overwrite existing writable files. This vulnerability is fixed in 2.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73: External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T21:26:26.154Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/truelockmc/streambert/security/advisories/GHSA-v74h-2468-rxhh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-v74h-2468-rxhh"
        }
      ],
      "source": {
        "advisory": "GHSA-v74h-2468-rxhh",
        "discovery": "UNKNOWN"
      },
      "title": "Streambert: Local File Exfiltration and Overwrite via Subtitle file: Protocol"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52872",
    "datePublished": "2026-08-18T21:26:26.154Z",
    "dateReserved": "2026-06-08T21:44:27.364Z",
    "dateUpdated": "2026-08-18T21:26:26.154Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48056 (GCVE-0-2026-48056)

Vulnerability from nvd – Published: 2026-08-11 13:52 – Updated: 2026-08-11 18:22

Title

Streambert Vulnerable to Arbitrary Binary Execution via Downloader IPC Handler

Summary

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the run-download IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s privileges. Version 2.5.0 contains a patch.

Severity

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 18:20 UTC

CWE

CWE-20 - Improper Input Validation
CWE-749 - Exposed Dangerous Method or Function

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/truelockmc/streambert/security…	x_refsource_CONFIRM
https://github.com/truelockmc/streambert/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
truelockmc	streambert	Affected: < 2.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48056",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T18:20:36.677202Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T18:22:32.697Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-x267-77m6-qjc9"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "streambert",
          "vendor": "truelockmc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0  improperly validate executable paths supplied to the \u00a0run-download\u00a0 IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application\u2019s privileges. Version 2.5.0 contains a patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-749",
              "description": "CWE-749: Exposed Dangerous Method or Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T13:52:45.251Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/truelockmc/streambert/security/advisories/GHSA-x267-77m6-qjc9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-x267-77m6-qjc9"
        },
        {
          "name": "https://github.com/truelockmc/streambert/releases/tag/2.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/releases/tag/2.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-x267-77m6-qjc9",
        "discovery": "UNKNOWN"
      },
      "title": "Streambert Vulnerable to Arbitrary Binary Execution via Downloader IPC Handler"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48056",
    "datePublished": "2026-08-11T13:52:45.251Z",
    "dateReserved": "2026-05-20T18:25:25.706Z",
    "dateUpdated": "2026-08-11T18:22:32.697Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48046 (GCVE-0-2026-48046)

Vulnerability from nvd – Published: 2026-08-11 13:08 – Updated: 2026-08-13 15:16

Title

Streambert Vulnerable to Remote Code Execution (RCE) via Unvalidated Auto-Updater IPC Handler

Summary

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated auto-updater URL vulnerability that allows a compromised renderer process to make the main process download and execute an arbitrary binary, resulting in remote code execution. Version 2.5.0 contains a patch.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 15:16 UTC

CWE

CWE-494 - Download of Code Without Integrity Check

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/truelockmc/streambert/security…	x_refsource_CONFIRM
https://github.com/truelockmc/streambert/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
truelockmc	streambert	Affected: < 2.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48046",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T15:16:19.108153Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T15:16:26.952Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-vj74-r9xm-37mj"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "streambert",
          "vendor": "truelockmc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated auto-updater URL vulnerability that allows a compromised renderer process to make the main process download and execute an arbitrary binary, resulting in remote code execution. Version 2.5.0 contains a patch."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-494",
              "description": "CWE-494: Download of Code Without Integrity Check",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T13:08:45.848Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/truelockmc/streambert/security/advisories/GHSA-vj74-r9xm-37mj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-vj74-r9xm-37mj"
        },
        {
          "name": "https://github.com/truelockmc/streambert/releases/tag/2.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/releases/tag/2.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-vj74-r9xm-37mj",
        "discovery": "UNKNOWN"
      },
      "title": "Streambert Vulnerable to Remote Code Execution (RCE) via Unvalidated Auto-Updater IPC Handler"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48046",
    "datePublished": "2026-08-11T13:08:45.848Z",
    "dateReserved": "2026-05-20T18:15:53.578Z",
    "dateUpdated": "2026-08-13T15:16:26.952Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48055 (GCVE-0-2026-48055)

Vulnerability from nvd – Published: 2026-06-16 21:17 – Updated: 2026-06-17 13:22

Title

Streambert: Arbitrary File Write (Zip Slip) via Subtitle Extraction

Summary

Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability was identified in Streambert's subtitle extraction logic. The application does not sanitize archive entry filenames during extraction, allowing a malicious archive to perform path traversal and write arbitrary files to the host filesystem. The subtitle extraction process downloads a ZIP archive and extracts its entries. The destination file path is constructed by concatenating the raw archive entry name (extracted.name) directly to the temporary directory path. If a malicious ZIP archive containing directory traversal sequences is processed, it escapes the temporary directory boundaries. The application then writes the extracted payload anywhere on the host filesystem subject to the application's current write permissions. This issue has been fixed in version 2.5.0.

Severity

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-17 13:22 UTC

CWE

CWE-20 - Improper Input Validation
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/truelockmc/streambert/security…	x_refsource_CONFIRM
https://github.com/truelockmc/streambert/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
truelockmc	streambert	Affected: < 2.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48055",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T13:22:09.740440Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-17T13:22:28.962Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-3q2x-3q9p-qwfc"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "streambert",
          "vendor": "truelockmc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability was identified in Streambert\u0027s subtitle extraction logic. The application does not sanitize archive entry filenames during extraction, allowing a malicious archive to perform path traversal and write arbitrary files to the host filesystem. The subtitle extraction process downloads a ZIP archive and extracts its entries. The destination file path is constructed by concatenating the raw archive entry name (extracted.name) directly to the temporary directory path. If a malicious ZIP archive containing directory traversal sequences is processed, it escapes the temporary directory boundaries. The application then writes the extracted payload anywhere on the host filesystem subject to the application\u0027s current write permissions. This issue has been fixed in version 2.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-16T21:17:59.868Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/truelockmc/streambert/security/advisories/GHSA-3q2x-3q9p-qwfc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-3q2x-3q9p-qwfc"
        },
        {
          "name": "https://github.com/truelockmc/streambert/releases/tag/2.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/releases/tag/2.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-3q2x-3q9p-qwfc",
        "discovery": "UNKNOWN"
      },
      "title": "Streambert: Arbitrary File Write (Zip Slip) via Subtitle Extraction"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48055",
    "datePublished": "2026-06-16T21:17:59.868Z",
    "dateReserved": "2026-05-20T18:15:53.579Z",
    "dateUpdated": "2026-06-17T13:22:28.962Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52875 (GCVE-0-2026-52875)

Vulnerability from cvelistv5 – Published: 2026-08-18 21:30 – Updated: 2026-08-18 21:30

Title

Streambert: Arbitrary Directory Creation and File Manipulation via Backup Handler

Summary

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync, fs.readdirSync, and fs.unlinkSync operations without checking that it is inside an authorized backup location. A compromised renderer can choose an absolute path or a relative traversal path to create directories and write a streambert-backup-[timestamp].json file containing renderer-controlled data. The pruning loop can also delete files in that directory whose names begin with streambert-backup- and end with .json. This vulnerability is fixed in 2.6.0.

Severity

8.4 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73 - External Control of File Name or Path

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/truelockmc/streambert/security…	x_refsource_CONFIRM
https://github.com/truelockmc/streambert/pull/149	x_refsource_MISC
http://github.com/truelockmc/streambert/commit/43…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
truelockmc	streambert	Affected: < 2.6.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "streambert",
          "vendor": "truelockmc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.6.0, the perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync, fs.readdirSync, and fs.unlinkSync operations without checking that it is inside an authorized backup location. A compromised renderer can choose an absolute path or a relative traversal path to create directories and write a streambert-backup-[timestamp].json file containing renderer-controlled data. The pruning loop can also delete files in that directory whose names begin with streambert-backup- and end with .json. This vulnerability is fixed in 2.6.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73: External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T21:30:48.370Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/truelockmc/streambert/security/advisories/GHSA-c64m-cx97-6rc9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-c64m-cx97-6rc9"
        },
        {
          "name": "https://github.com/truelockmc/streambert/pull/149",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/pull/149"
        },
        {
          "name": "http://github.com/truelockmc/streambert/commit/43566ed031183b046675761c9813c5379b619269",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://github.com/truelockmc/streambert/commit/43566ed031183b046675761c9813c5379b619269"
        }
      ],
      "source": {
        "advisory": "GHSA-c64m-cx97-6rc9",
        "discovery": "UNKNOWN"
      },
      "title": "Streambert: Arbitrary Directory Creation and File Manipulation via Backup Handler"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52875",
    "datePublished": "2026-08-18T21:30:48.370Z",
    "dateReserved": "2026-06-08T21:44:27.364Z",
    "dateUpdated": "2026-08-18T21:30:48.370Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52876 (GCVE-0-2026-52876)

Vulnerability from cvelistv5 – Published: 2026-08-18 21:29 – Updated: 2026-08-18 21:29

Title

Streambert: Arbitrary File Execution via VLC/mpv Launcher Fallback

Summary

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or fail, the handler passes filePath to Electron's shell.openPath. A compromised renderer can provide the path of a local executable, script, shortcut, or other file with an executing default handler, causing the operating system to launch it with the privileges of the StreamBERT process and enabling escape from the renderer sandbox. This issue is fixed in version 2.6.0.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-20 - Improper Input Validation
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/truelockmc/streambert/security…	x_refsource_CONFIRM
https://github.com/truelockmc/streambert/pull/149	x_refsource_MISC
https://github.com/truelockmc/streambert/commit/4…	x_refsource_MISC
https://github.com/truelockmc/streambert/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
truelockmc	streambert	Affected: < 2.6.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "streambert",
          "vendor": "truelockmc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or fail, the handler passes filePath to Electron\u0027s shell.openPath. A compromised renderer can provide the path of a local executable, script, shortcut, or other file with an executing default handler, causing the operating system to launch it with the privileges of the StreamBERT process and enabling escape from the renderer sandbox. This issue is fixed in version 2.6.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T21:29:08.476Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/truelockmc/streambert/security/advisories/GHSA-85vf-2qwc-qpm4",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-85vf-2qwc-qpm4"
        },
        {
          "name": "https://github.com/truelockmc/streambert/pull/149",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/pull/149"
        },
        {
          "name": "https://github.com/truelockmc/streambert/commit/43566ed031183b046675761c9813c5379b619269",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/commit/43566ed031183b046675761c9813c5379b619269"
        },
        {
          "name": "https://github.com/truelockmc/streambert/releases/tag/2.6.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/releases/tag/2.6.0"
        }
      ],
      "source": {
        "advisory": "GHSA-85vf-2qwc-qpm4",
        "discovery": "UNKNOWN"
      },
      "title": "Streambert: Arbitrary File Execution via VLC/mpv Launcher Fallback"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52876",
    "datePublished": "2026-08-18T21:29:08.476Z",
    "dateReserved": "2026-06-08T21:44:27.364Z",
    "dateUpdated": "2026-08-18T21:29:08.476Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52873 (GCVE-0-2026-52873)

Vulnerability from cvelistv5 – Published: 2026-08-18 21:28 – Updated: 2026-08-18 21:28

Title

Streambert: Global CSP Removal in Wyzie Redeem Window Enables Unconstrained XSS in Electron Renderer

Summary

Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC handler in index.js creates the partition:wyzie-redeem Electron session and registers an onHeadersReceived hook that removes the Content-Security-Policy header from every response in that session. The redeem window also lacks a setWindowOpenHandler restriction, so script injection in sub.wyzie.io, a loaded third-party resource, or a site reached through navigation executes without CSP constraints and can affect additional windows and persistent session storage. A user must open the Wyzie API key redemption window, and exploitation requires attacker-controlled script content in a loaded page. The resulting renderer script can invoke renderer-exposed application functionality and can be chained with other vulnerabilities to access internal services or sensitive data. This issue is fixed in version 2.6.0.

Severity

6.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-693 - Protection Mechanism Failure

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/truelockmc/streambert/security…	x_refsource_CONFIRM
https://github.com/truelockmc/streambert/pull/126	x_refsource_MISC
https://github.com/truelockmc/streambert/commit/0…	x_refsource_MISC
https://github.com/truelockmc/streambert/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
truelockmc	streambert	Affected: < 2.6.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "streambert",
          "vendor": "truelockmc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC handler in index.js creates the partition:wyzie-redeem Electron session and registers an onHeadersReceived hook that removes the Content-Security-Policy header from every response in that session. The redeem window also lacks a setWindowOpenHandler restriction, so script injection in sub.wyzie.io, a loaded third-party resource, or a site reached through navigation executes without CSP constraints and can affect additional windows and persistent session storage. A user must open the Wyzie API key redemption window, and exploitation requires attacker-controlled script content in a loaded page. The resulting renderer script can invoke renderer-exposed application functionality and can be chained with other vulnerabilities to access internal services or sensitive data. This issue is fixed in version 2.6.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T21:28:18.806Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/truelockmc/streambert/security/advisories/GHSA-2j2q-qvpf-wh43",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-2j2q-qvpf-wh43"
        },
        {
          "name": "https://github.com/truelockmc/streambert/pull/126",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/pull/126"
        },
        {
          "name": "https://github.com/truelockmc/streambert/commit/0bd6b6ca8c830f22f75de1aa2e0d8b9bdf6d34c7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/commit/0bd6b6ca8c830f22f75de1aa2e0d8b9bdf6d34c7"
        },
        {
          "name": "https://github.com/truelockmc/streambert/releases/tag/2.6.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/releases/tag/2.6.0"
        }
      ],
      "source": {
        "advisory": "GHSA-2j2q-qvpf-wh43",
        "discovery": "UNKNOWN"
      },
      "title": "Streambert: Global CSP Removal in Wyzie Redeem Window Enables Unconstrained XSS in Electron Renderer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52873",
    "datePublished": "2026-08-18T21:28:18.806Z",
    "dateReserved": "2026-06-08T21:44:27.364Z",
    "dateUpdated": "2026-08-18T21:28:18.806Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52877 (GCVE-0-2026-52877)

Vulnerability from cvelistv5 – Published: 2026-08-18 21:27 – Updated: 2026-08-18 21:27

Title

Streambert : Insecure Protocol Execution in open-external IPC Handler

Summary

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal without validating its protocol. A compromised renderer can submit file: URIs or operating-system-specific custom schemes, causing the host to open local files, access remote resources through registered handlers, or launch scripts and applications supported by those handlers. This issue is fixed in version 2.6.0.

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

CWE

CWE-20 - Improper Input Validation
CWE-749 - Exposed Dangerous Method or Function

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/truelockmc/streambert/security…	x_refsource_CONFIRM
https://github.com/truelockmc/streambert/commit/8…	x_refsource_MISC
https://github.com/truelockmc/streambert/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
truelockmc	streambert	Affected: < 2.6.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "streambert",
          "vendor": "truelockmc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron\u0027s shell.openExternal without validating its protocol. A compromised renderer can submit file: URIs or operating-system-specific custom schemes, causing the host to open local files, access remote resources through registered handlers, or launch scripts and applications supported by those handlers. This issue is fixed in version 2.6.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-749",
              "description": "CWE-749: Exposed Dangerous Method or Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T21:27:23.802Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/truelockmc/streambert/security/advisories/GHSA-j2vw-gg3g-wwqr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-j2vw-gg3g-wwqr"
        },
        {
          "name": "https://github.com/truelockmc/streambert/commit/8fd7eb1d358d1d69e57e51ddfa71b066b44ff616",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/commit/8fd7eb1d358d1d69e57e51ddfa71b066b44ff616"
        },
        {
          "name": "https://github.com/truelockmc/streambert/releases/tag/2.6.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/releases/tag/2.6.0"
        }
      ],
      "source": {
        "advisory": "GHSA-j2vw-gg3g-wwqr",
        "discovery": "UNKNOWN"
      },
      "title": "Streambert : Insecure Protocol Execution in open-external IPC Handler"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52877",
    "datePublished": "2026-08-18T21:27:23.802Z",
    "dateReserved": "2026-06-08T21:44:27.364Z",
    "dateUpdated": "2026-08-18T21:27:23.802Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52872 (GCVE-0-2026-52872)

Vulnerability from cvelistv5 – Published: 2026-08-18 21:26 – Updated: 2026-08-18 21:26

Title

Streambert: Local File Exfiltration and Overwrite via Subtitle file: Protocol

Summary

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its decoded pathname to fs.copyFileSync. The renderer also controls downloadPath, which determines the destination path. A compromised renderer can therefore copy any file readable by the StreamBERT process into an attacker-chosen writable location, exposing sensitive local data, and can overwrite existing writable files. This vulnerability is fixed in 2.5.0.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73 - External Control of File Name or Path

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/truelockmc/streambert/security…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
truelockmc	streambert	Affected: < 2.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "streambert",
          "vendor": "truelockmc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its decoded pathname to fs.copyFileSync. The renderer also controls downloadPath, which determines the destination path. A compromised renderer can therefore copy any file readable by the StreamBERT process into an attacker-chosen writable location, exposing sensitive local data, and can overwrite existing writable files. This vulnerability is fixed in 2.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73: External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T21:26:26.154Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/truelockmc/streambert/security/advisories/GHSA-v74h-2468-rxhh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-v74h-2468-rxhh"
        }
      ],
      "source": {
        "advisory": "GHSA-v74h-2468-rxhh",
        "discovery": "UNKNOWN"
      },
      "title": "Streambert: Local File Exfiltration and Overwrite via Subtitle file: Protocol"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52872",
    "datePublished": "2026-08-18T21:26:26.154Z",
    "dateReserved": "2026-06-08T21:44:27.364Z",
    "dateUpdated": "2026-08-18T21:26:26.154Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48056 (GCVE-0-2026-48056)

Vulnerability from cvelistv5 – Published: 2026-08-11 13:52 – Updated: 2026-08-11 18:22

Title

Streambert Vulnerable to Arbitrary Binary Execution via Downloader IPC Handler

Summary

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the run-download IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s privileges. Version 2.5.0 contains a patch.

Severity

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-11 18:20 UTC

CWE

CWE-20 - Improper Input Validation
CWE-749 - Exposed Dangerous Method or Function

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/truelockmc/streambert/security…	x_refsource_CONFIRM
https://github.com/truelockmc/streambert/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
truelockmc	streambert	Affected: < 2.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48056",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-11T18:20:36.677202Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-11T18:22:32.697Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-x267-77m6-qjc9"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "streambert",
          "vendor": "truelockmc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0  improperly validate executable paths supplied to the \u00a0run-download\u00a0 IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application\u2019s privileges. Version 2.5.0 contains a patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-749",
              "description": "CWE-749: Exposed Dangerous Method or Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T13:52:45.251Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/truelockmc/streambert/security/advisories/GHSA-x267-77m6-qjc9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-x267-77m6-qjc9"
        },
        {
          "name": "https://github.com/truelockmc/streambert/releases/tag/2.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/releases/tag/2.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-x267-77m6-qjc9",
        "discovery": "UNKNOWN"
      },
      "title": "Streambert Vulnerable to Arbitrary Binary Execution via Downloader IPC Handler"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48056",
    "datePublished": "2026-08-11T13:52:45.251Z",
    "dateReserved": "2026-05-20T18:25:25.706Z",
    "dateUpdated": "2026-08-11T18:22:32.697Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48046 (GCVE-0-2026-48046)

Vulnerability from cvelistv5 – Published: 2026-08-11 13:08 – Updated: 2026-08-13 15:16

Title

Streambert Vulnerable to Remote Code Execution (RCE) via Unvalidated Auto-Updater IPC Handler

Summary

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated auto-updater URL vulnerability that allows a compromised renderer process to make the main process download and execute an arbitrary binary, resulting in remote code execution. Version 2.5.0 contains a patch.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 15:16 UTC

CWE

CWE-494 - Download of Code Without Integrity Check

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/truelockmc/streambert/security…	x_refsource_CONFIRM
https://github.com/truelockmc/streambert/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
truelockmc	streambert	Affected: < 2.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48046",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T15:16:19.108153Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T15:16:26.952Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-vj74-r9xm-37mj"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "streambert",
          "vendor": "truelockmc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated auto-updater URL vulnerability that allows a compromised renderer process to make the main process download and execute an arbitrary binary, resulting in remote code execution. Version 2.5.0 contains a patch."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-494",
              "description": "CWE-494: Download of Code Without Integrity Check",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T13:08:45.848Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/truelockmc/streambert/security/advisories/GHSA-vj74-r9xm-37mj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-vj74-r9xm-37mj"
        },
        {
          "name": "https://github.com/truelockmc/streambert/releases/tag/2.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/releases/tag/2.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-vj74-r9xm-37mj",
        "discovery": "UNKNOWN"
      },
      "title": "Streambert Vulnerable to Remote Code Execution (RCE) via Unvalidated Auto-Updater IPC Handler"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48046",
    "datePublished": "2026-08-11T13:08:45.848Z",
    "dateReserved": "2026-05-20T18:15:53.578Z",
    "dateUpdated": "2026-08-13T15:16:26.952Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48055 (GCVE-0-2026-48055)

Vulnerability from cvelistv5 – Published: 2026-06-16 21:17 – Updated: 2026-06-17 13:22

Title

Streambert: Arbitrary File Write (Zip Slip) via Subtitle Extraction

Summary

Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability was identified in Streambert's subtitle extraction logic. The application does not sanitize archive entry filenames during extraction, allowing a malicious archive to perform path traversal and write arbitrary files to the host filesystem. The subtitle extraction process downloads a ZIP archive and extracts its entries. The destination file path is constructed by concatenating the raw archive entry name (extracted.name) directly to the temporary directory path. If a malicious ZIP archive containing directory traversal sequences is processed, it escapes the temporary directory boundaries. The application then writes the extracted payload anywhere on the host filesystem subject to the application's current write permissions. This issue has been fixed in version 2.5.0.

Severity

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-17 13:22 UTC

CWE

CWE-20 - Improper Input Validation
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/truelockmc/streambert/security…	x_refsource_CONFIRM
https://github.com/truelockmc/streambert/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
truelockmc	streambert	Affected: < 2.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48055",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T13:22:09.740440Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-17T13:22:28.962Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-3q2x-3q9p-qwfc"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "streambert",
          "vendor": "truelockmc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability was identified in Streambert\u0027s subtitle extraction logic. The application does not sanitize archive entry filenames during extraction, allowing a malicious archive to perform path traversal and write arbitrary files to the host filesystem. The subtitle extraction process downloads a ZIP archive and extracts its entries. The destination file path is constructed by concatenating the raw archive entry name (extracted.name) directly to the temporary directory path. If a malicious ZIP archive containing directory traversal sequences is processed, it escapes the temporary directory boundaries. The application then writes the extracted payload anywhere on the host filesystem subject to the application\u0027s current write permissions. This issue has been fixed in version 2.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-16T21:17:59.868Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/truelockmc/streambert/security/advisories/GHSA-3q2x-3q9p-qwfc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-3q2x-3q9p-qwfc"
        },
        {
          "name": "https://github.com/truelockmc/streambert/releases/tag/2.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/truelockmc/streambert/releases/tag/2.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-3q2x-3q9p-qwfc",
        "discovery": "UNKNOWN"
      },
      "title": "Streambert: Arbitrary File Write (Zip Slip) via Subtitle Extraction"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48055",
    "datePublished": "2026-06-16T21:17:59.868Z",
    "dateReserved": "2026-05-20T18:15:53.579Z",
    "dateUpdated": "2026-06-17T13:22:28.962Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

16 vulnerabilities found for streambert by truelockmc

CVE-2026-52877 (GCVE-0-2026-52877)

CVE-2026-52876 (GCVE-0-2026-52876)

CVE-2026-52875 (GCVE-0-2026-52875)

CVE-2026-52873 (GCVE-0-2026-52873)

CVE-2026-52872 (GCVE-0-2026-52872)

CVE-2026-48056 (GCVE-0-2026-48056)

CVE-2026-48046 (GCVE-0-2026-48046)

CVE-2026-48055 (GCVE-0-2026-48055)

CVE-2026-52875 (GCVE-0-2026-52875)

CVE-2026-52876 (GCVE-0-2026-52876)

CVE-2026-52873 (GCVE-0-2026-52873)

CVE-2026-52877 (GCVE-0-2026-52877)

CVE-2026-52872 (GCVE-0-2026-52872)

CVE-2026-48056 (GCVE-0-2026-48056)

CVE-2026-48046 (GCVE-0-2026-48046)

CVE-2026-48055 (GCVE-0-2026-48055)