Which versions of Streambert are affected by CVE-2026-48046?

Streambert desktop application versions before 2.5.0 contain a critical remote code execution vulnerability that allows full system compromise through the application's auto-updater mechanism.. A patch is available.

How to fix or mitigate CVE-2026-48046?

Within 24 hours, identify all endpoints running Streambert versions prior to 2.5.0 through endpoint discovery tools or software asset management systems. Within 7 days, complete rollout of Streambert 2.5.0 or later to all affected users, prioritizing systems with access to sensitive data or critical network segments. Within 30 days, conduct a comprehensive risk assessment for any systems that ran vulnerable versions during the deployment window and implement monitoring for indicators of compromise including unexpected binary execution, suspicious auto-updater activity, or privilege escalation events.

Streambert CVE-2026-48046

Q: What is the CVSS score of CVE-2026-48046?

CVE-2026-48046 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-56146 CRITICAL

Download of Code Without Integrity Check (CWE-494)

2026-08-11 GitHub_M

RCE Streambert Truelockmc

9.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.0 CRITICAL

AC:H and S:C because exploitation first requires compromising the sandboxed renderer, which then crosses a trust boundary to drive the privileged main process into full-impact code execution.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 11, 2026 - 14:17 EUVD

Source Code Evidence Fetched

Aug 11, 2026 - 14:00 vuln.today

Analysis Generated

Aug 11, 2026 - 14:00 vuln.today

CVE Published

Aug 11, 2026 - 13:08 cve.org

CRITICAL 9.3

DescriptionCVE.org

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated auto-updater URL vulnerability that allows a compromised renderer process to make the main process download and execute an arbitrary binary, resulting in remote code execution. Version 2.5.0 contains a patch.

AnalysisAI

Remote code execution in Streambert (Electron desktop streaming/download app) versions before 2.5.0 lets a compromised renderer process coerce the trusted main process into fetching and executing an arbitrary binary through an unvalidated auto-updater URL. Any attacker who first gains control of the renderer - for example via malicious streamed web content or an XSS-style flaw - can escalate that foothold into full code execution on the host. Fixed in 2.5.0; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The flaw sits in Electron's auto-update mechanism, where the privileged Node.js-enabled main process is responsible for downloading and launching update binaries. Because the update endpoint URL is not validated or pinned, a renderer that an attacker controls can supply or redirect the update source, and the main process downloads and runs the returned executable without an integrity/signature check. This is a textbook CWE-494 (Download of Code Without Integrity Check): trust is placed in an attacker-influenceable channel rather than a verified signature or fixed HTTPS origin. The single affected package is identified by CPE cpe:2.3:a:truelockmc:streambert, an independent open-source project distributed as .deb, .pacman, and AUR (streambert-bin) builds plus a Codeberg mirror.

RemediationAI

Vendor-released patch: version 2.5.0 - upgrade all installations to 2.5.0 or later, which also bundles fixes for two other advisories (GHSA-3q2x-3q9p-qwfc and GHSA-x267-77m6-qjc9) reported alongside this one; see https://github.com/truelockmc/streambert/releases/tag/2.5.0 and the advisory at https://github.com/truelockmc/streambert/security/advisories/GHSA-vj74-r9xm-37mj. If an immediate upgrade is not possible, the practical compensating control is to prevent the vulnerable update path from firing: disable or block the in-app auto-updater and update manually from a verified release, and use host/network egress controls to restrict the app from reaching arbitrary update download hosts (allow only the known GitHub release origin). The trade-off is that disabling auto-update forfeits future security fixes unless a manual update process is put in place, so treat this strictly as a stopgap until 2.5.0 is deployed.