CVE-2026-52876

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-52876

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52876.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-52876

Aliases

GHSA-85vf-2qwc-qpm4

Published

2026-08-18T21:29:08Z

Modified

2026-09-11T03:30:41Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Streambert: Arbitrary File Execution via VLC/mpv Launcher Fallback

Details

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or fail, the handler passes filePath to Electron's shell.openPath. A compromised renderer can provide the path of a local executable, script, shortcut, or other file with an executing default handler, causing the operating system to launch it with the privileges of the StreamBERT process and enabling escape from the renderer sandbox. This issue is fixed in version 2.6.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-20",
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52876.json"
}

References

Affected packages

Git / github.com/truelockmc/streambert

Affected ranges

Type

GIT

Repo

https://github.com/truelockmc/streambert

Events

Introduced

Fixed

43566ed031183b046675761c9813c5379b619269

Fixed

9ab0f9d8ddc29c316a6084cad19c4f76df908251

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.6.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.2

0.2.1

0.3.0

1.*

1.0

1.1

1.2

1.3

1.4

1.5

1.6

1.7

2.*

2.0

2.1

2.2

2.2.1

2.3

2.4

2.5.0

v.*

v.2.3.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52876.json"