CVE-2026-52877

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-52877

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52877.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-52877

Aliases

GHSA-j2vw-gg3g-wwqr

Published

2026-08-18T21:27:23Z

Modified

2026-09-11T03:30:48Z

Severity

8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L CVSS Calculator

Summary

Streambert : Insecure Protocol Execution in open-external IPC Handler

Details

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal without validating its protocol. A compromised renderer can submit file: URIs or operating-system-specific custom schemes, causing the host to open local files, access remote resources through registered handlers, or launch scripts and applications supported by those handlers. This issue is fixed in version 2.6.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-20",
        "CWE-749"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52877.json"
}

References

Affected packages

Git / github.com/truelockmc/streambert

Affected ranges

Type

GIT

Repo

https://github.com/truelockmc/streambert

Events

Introduced

Fixed

8fd7eb1d358d1d69e57e51ddfa71b066b44ff616

Fixed

9ab0f9d8ddc29c316a6084cad19c4f76df908251

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.6.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.2

0.2.1

0.3.0

1.*

1.0

1.1

1.2

1.3

1.4

1.5

1.6

1.7

2.*

2.0

2.1

2.2

2.2.1

2.3

2.4

2.5.0

v.*

v.2.3.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-52877.json"