EUVD-2026-62195Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Renderer compromise provides low-privilege local access (PR:L/AV:L); crossing the IPC boundary to the main process with unchecked file operations constitutes scope change (S:C) with full read/write impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its decoded pathname to fs.copyFileSync. The renderer also controls downloadPath, which determines the destination path. A compromised renderer can therefore copy any file readable by the StreamBERT process into an attacker-chosen writable location, exposing sensitive local data, and can overwrite existing writable files. This vulnerability is fixed in 2.5.0.
AnalysisAI
Path traversal in Streambert (versions prior to 2.5.0) allows a compromised Electron renderer process to abuse the run-download IPC channel to copy arbitrary files readable by the Streambert process into attacker-controlled locations, and to overwrite existing writable files on the host system. The downloadSubtitleFile utility in src/ipc/downloads.js accepts renderer-supplied file: URIs and destination paths without sanitization, passing them directly to fs.copyFileSync - crossing the Electron IPC boundary without restriction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker first achieve code execution within the Streambert renderer process - this is not a direct unauthenticated remote attack. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score is driven primarily by Scope:Changed (S:C) - the renderer process escapes its normal sandbox by routing through the unvalidated main-process IPC handler, gaining read access to all files readable by StreamBERT and write access to all writable paths. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Streambert 2.5.0 or later, which is confirmed by the vendor advisory (https://github.com/truelockmc/streambert/security/advisories/GHSA-v74h-2468-rxhh) to fix the path traversal in downloadSubtitleFile. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Streambert prior to version 2.5.0 and assess dependencies and deployment context. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today