EUVD-2026-62198Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
AV:L because exploitation requires local renderer execution context; PR:L as unprivileged user sufficient; S:C for confirmed sandbox escape crossing renderer-to-main-process boundary.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or fail, the handler passes filePath to Electron's shell.openPath. A compromised renderer can provide the path of a local executable, script, shortcut, or other file with an executing default handler, causing the operating system to launch it with the privileges of the StreamBERT process and enabling escape from the renderer sandbox. This issue is fixed in version 2.6.0.
AnalysisAI
Sandbox escape in Streambert Desktop App (all versions prior to 2.6.0) allows a compromised renderer process to pass an arbitrary local file path - including executables, scripts, or OS shortcuts - to Electron's shell.openPath, causing the host OS to launch the file with the StreamBERT main process's privileges. The vulnerable IPC handler open-path-at-time in src/ipc/player.js accepted renderer-supplied filePath values with no type checking, extension filtering, or real-path validation, making the fallback to shell.openPath an unrestricted local code-execution primitive. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two sequential conditions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H accurately characterizes the severity: low-complexity, no-user-interaction sandbox escape with full confidentiality, integrity, and availability impact on the host environment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Streambert 2.6.0 immediately; the patched release is available at https://github.com/truelockmc/streambert/releases/tag/2.6.0 and the fix commit is at https://github.com/truelockmc/streambert/commit/43566ed031183b046675761c9813c5379b619269. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: conduct an inventory audit to identify all systems running Streambert Desktop App versions prior to 2.6.0 and notify affected teams that patch version 2.6.0 is required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today