EUVD-2026-56148Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
AC:H and UI:R because exploitation requires first compromising the renderer via loaded malicious content; S:C and C/I/A:H reflect renderer-to-host arbitrary code execution with app privileges.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the run-download IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s privileges. Version 2.5.0 contains a patch.
AnalysisAI
Local arbitrary binary execution in Streambert, a cross-platform Electron desktop app for streaming and downloading video, affects all versions prior to 2.5.0 because the 'run-download' IPC handler fails to validate executable paths it receives. A renderer process that has already been compromised can invoke this handler to launch any local binary with the application's privileges, effectively escaping the renderer sandbox into full host code execution. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through GitHub (advisory GHSA-x267-77m6-qjc9) and fixed in version 2.5.0.
Technical ContextAI
This is an Electron IPC trust-boundary weakness (CWE-20, improper input validation). Electron apps split into a privileged main (Node.js) process and one or more renderer (Chromium) processes; the renderer is expected to be treated as untrusted because it loads and executes remote/streamed web content. Streambert exposes a 'run-download' IPC channel intended to invoke a downloader binary, but the main process accepts a caller-supplied executable path without validating it against an allowlist or fixed path. Because the main process runs the named binary with the application's OS privileges, any attacker who controls messages sent over that IPC channel controls what executes on the host. CPE cpe:2.3:a:truelockmc:streambert:*:*:*:*:*:*:*:* confirms the affected product is truelockmc's Streambert application across all versions up to the fix.
RemediationAI
Vendor-released patch: 2.5.0 - upgrade to Streambert 2.5.0 or later, which the release notes describe as fixing three critical vulnerabilities including GHSA-x267-77m6-qjc9 and adding an improved video-downloader file validator (PR #68). Obtain the fix from https://github.com/truelockmc/streambert/releases/tag/2.5.0 (AUR users: update streambert-bin; Codeberg mirror updating is noted as a future capability). If immediate upgrade is not possible, compensating controls include restricting who can run the app on multi-user hosts and removing/renaming any high-value local binaries the handler could invoke, though these do not close the root cause; more effective is to avoid loading untrusted or third-party streaming sources in the app, since renderer compromise is the required precondition - the trade-off is reduced functionality. Given the app self-updates, ensure the in-app updater itself is on a trusted 2.5.0+ build before relying on it.
More in Streambert
View allArbitrary file write in Streambert Electron desktop app (versions ≤2.4.0) allows remote attackers to drop files anywhere
Remote code execution in Streambert (Electron desktop streaming/download app) versions before 2.5.0 lets a compromised r
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today