What is the CVSS score of CVE-2026-48056?

CVE-2026-48056 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Streambert are affected by CVE-2026-48056?

Streambert, a cross-platform desktop video streaming application, contains a critical arbitrary code execution vulnerability (CVSS 10.0) that could allow complete compromise of affected workstations…. A patch is available.

How to fix or mitigate CVE-2026-48056?

Within 24 hours: Issue security directive immediately prohibiting Streambert use until patched and inventory all systems running Streambert across all deployment methods. Within 7 days: Deploy Streambert version 2.5.0 or later after validating compatibility in a non-production environment and confirming successful upgrades on at least 95% of target endpoints. Within 30 days: Complete deployment of version 2.5.0 or later across all systems and audit endpoint logs for suspicious process execution patterns that might indicate pre-patch exploitation attempts.

Streambert CVE-2026-48056

EUVD-2026-56148 CRITICAL

Improper Input Validation (CWE-20)

2026-08-11 GitHub_M

Information Disclosure Streambert Truelockmc

10.0

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

AC:H and UI:R because exploitation requires first compromising the renderer via loaded malicious content; S:C and C/I/A:H reflect renderer-to-host arbitrary code execution with app privileges.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 11, 2026 - 15:17 EUVD

Source Code Evidence Fetched

Aug 11, 2026 - 14:36 vuln.today

Analysis Generated

Aug 11, 2026 - 14:36 vuln.today

CVE Published

Aug 11, 2026 - 13:52 cve.org

CRITICAL 10.0

DescriptionCVE.org

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the run-download IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s privileges. Version 2.5.0 contains a patch.

AnalysisAI

Local arbitrary binary execution in Streambert, a cross-platform Electron desktop app for streaming and downloading video, affects all versions prior to 2.5.0 because the 'run-download' IPC handler fails to validate executable paths it receives. A renderer process that has already been compromised can invoke this handler to launch any local binary with the application's privileges, effectively escaping the renderer sandbox into full host code execution. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through GitHub (advisory GHSA-x267-77m6-qjc9) and fixed in version 2.5.0.

Technical ContextAI

This is an Electron IPC trust-boundary weakness (CWE-20, improper input validation). Electron apps split into a privileged main (Node.js) process and one or more renderer (Chromium) processes; the renderer is expected to be treated as untrusted because it loads and executes remote/streamed web content. Streambert exposes a 'run-download' IPC channel intended to invoke a downloader binary, but the main process accepts a caller-supplied executable path without validating it against an allowlist or fixed path. Because the main process runs the named binary with the application's OS privileges, any attacker who controls messages sent over that IPC channel controls what executes on the host. CPE cpe:2.3:a:truelockmc:streambert:*:*:*:*:*:*:*:* confirms the affected product is truelockmc's Streambert application across all versions up to the fix.

RemediationAI

Vendor-released patch: 2.5.0 - upgrade to Streambert 2.5.0 or later, which the release notes describe as fixing three critical vulnerabilities including GHSA-x267-77m6-qjc9 and adding an improved video-downloader file validator (PR #68). Obtain the fix from https://github.com/truelockmc/streambert/releases/tag/2.5.0 (AUR users: update streambert-bin; Codeberg mirror updating is noted as a future capability). If immediate upgrade is not possible, compensating controls include restricting who can run the app on multi-user hosts and removing/renaming any high-value local binaries the handler could invoke, though these do not close the root cause; more effective is to avoid loading untrusted or third-party streaming sources in the app, since renderer compromise is the required precondition - the trade-off is reduced functionality. Given the app self-updates, ensure the in-app updater itself is on a trusted 2.5.0+ build before relying on it.