Arbitrary binary execution via IPC handler in Streambert (CVE-2026-48056)

The `run-download` IPC handler in Streambert accepts an arbitrary executable path (`binaryPath`) from the renderer process and spawns it via Node's `spawn` without any path validation. A compromised renderer process - for example through XSS or remote feed injection - can exploit this handler to execute arbitrary local binaries (such as `cmd.exe` or `powershell.exe`) with the privileges of the Streambert desktop application. The vulnerability is located in `src/ipc/downloads.js`. Affected versions: - <= 2.4.0 We recommend updating to: >= 2.5.0. CVSS 10.0 · our assessment: act_now Reference: https://github.com/truelockmc/streambert/security/advisories/GHSA-x267-77m6-qjc9 Details: https://vuln.today/cve/CVE-2026-48056