Remote code execution via unvalidated auto-updater IPC handler in Streambert (CVE-2026-48046)

Streambert's `download-and-install-update` IPC handler accepts a user-controlled URL from the renderer process without domain validation. A compromised renderer process - for example via XSS or an untrusted external stream source - can invoke this handler to cause the main process to download and execute an arbitrary binary on the host system. This results in remote code execution with the privileges of the running application. Affected versions: - <= 2.4.0 We recommend updating to: >= 2.5.0. CVSS 9.3 · our assessment: act_now Reference: https://github.com/truelockmc/streambert/security/advisories/GHSA-vj74-r9xm-37mj Details: https://vuln.today/cve/CVE-2026-48046