CVE-2026-52876

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-52876", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-08T21:44:27.364Z", "datePublished": "2026-08-18T21:29:08.476Z", "dateUpdated": "2026-08-19T18:19:44.618Z"}, "containers": {"cna": {"title": "Streambert: Arbitrary File Execution via VLC/mpv Launcher Fallback", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/truelockmc/streambert/security/advisories/GHSA-85vf-2qwc-qpm4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-85vf-2qwc-qpm4"}, {"name": "https://github.com/truelockmc/streambert/pull/149", "tags": ["x_refsource_MISC"], "url": "https://github.com/truelockmc/streambert/pull/149"}, {"name": "https://github.com/truelockmc/streambert/commit/43566ed031183b046675761c9813c5379b619269", "tags": ["x_refsource_MISC"], "url": "https://github.com/truelockmc/streambert/commit/43566ed031183b046675761c9813c5379b619269"}, {"name": "https://github.com/truelockmc/streambert/releases/tag/2.6.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/truelockmc/streambert/releases/tag/2.6.0"}], "affected": [{"vendor": "truelockmc", "product": "streambert", "versions": [{"version": "< 2.6.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T21:29:08.476Z"}, "descriptions": [{"lang": "en", "value": "Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or fail, the handler passes filePath to Electron's shell.openPath. A compromised renderer can provide the path of a local executable, script, shortcut, or other file with an executing default handler, causing the operating system to launch it with the privileges of the StreamBERT process and enabling escape from the renderer sandbox. This issue is fixed in version 2.6.0."}], "source": {"advisory": "GHSA-85vf-2qwc-qpm4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-19T18:16:21.866550Z", "id": "CVE-2026-52876", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T18:19:44.618Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-52876", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-19T18:16:21.866550Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T18:16:22.955Z"}}], "cna": {"title": "Streambert: Arbitrary File Execution via VLC/mpv Launcher Fallback", "source": {"advisory": "GHSA-85vf-2qwc-qpm4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "truelockmc", "product": "streambert", "versions": [{"status": "affected", "version": "< 2.6.0"}]}], "references": [{"url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-85vf-2qwc-qpm4", "name": "https://github.com/truelockmc/streambert/security/advisories/GHSA-85vf-2qwc-qpm4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/truelockmc/streambert/pull/149", "name": "https://github.com/truelockmc/streambert/pull/149", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/truelockmc/streambert/commit/43566ed031183b046675761c9813c5379b619269", "name": "https://github.com/truelockmc/streambert/commit/43566ed031183b046675761c9813c5379b619269", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/truelockmc/streambert/releases/tag/2.6.0", "name": "https://github.com/truelockmc/streambert/releases/tag/2.6.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or fail, the handler passes filePath to Electron's shell.openPath. A compromised renderer can provide the path of a local executable, script, shortcut, or other file with an executing default handler, causing the operating system to launch it with the privileges of the StreamBERT process and enabling escape from the renderer sandbox. This issue is fixed in version 2.6.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T21:29:08.476Z"}}}, "cveMetadata": {"cveId": "CVE-2026-52876", "state": "PUBLISHED", "dateUpdated": "2026-08-19T18:19:44.618Z", "dateReserved": "2026-06-08T21:44:27.364Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-18T21:29:08.476Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "streambert", "vendor": "truelockmc", "versions": [{"status": "affected", "version": "< 2.6.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or fail, the handler passes filePath to Electron's shell.openPath. A compromised renderer can provide the path of a local executable, script, shortcut, or other file with an executing default handler, causing the operating system to launch it with the privileges of the StreamBERT process and enabling escape from the renderer sandbox. This issue is fixed in version 2.6.0."}, {"lang": "es", "value": "Streambert es una aplicaci\u00f3n de escritorio Electron multiplataforma para transmitir y descargar contenido de video. Antes de la versi\u00f3n 2.6.0, el gestor IPC open-path-at-time en src/ipc/player.js acepta una ruta de archivo (filePath) controlada por el renderizador sin validar su tipo o ubicaci\u00f3n. Si los intentos de lanzamiento de mpv o VLC se omiten o fallan, el gestor pasa filePath a shell.openPath de Electron. Un renderizador comprometido puede proporcionar la ruta de un ejecutable local, script, acceso directo u otro archivo con un gestor predeterminado en ejecuci\u00f3n, haciendo que el sistema operativo lo inicie con los privilegios del proceso StreamBERT y permitiendo el escape del sandbox del renderizador. Este problema est\u00e1 solucionado en la versi\u00f3n 2.6.0."}], "id": "CVE-2026-52876", "lastModified": "2026-10-22T17:09:59.477", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-52876", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-19T18:16:21.866550Z", "version": "2.0.3"}}]}, "published": "2026-08-18T22:16:54.173", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/truelockmc/streambert/commit/43566ed031183b046675761c9813c5379b619269"}, {"source": "security-advisories@github.com", "url": "https://github.com/truelockmc/streambert/pull/149"}, {"source": "security-advisories@github.com", "url": "https://github.com/truelockmc/streambert/releases/tag/2.6.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/truelockmc/streambert/security/advisories/GHSA-85vf-2qwc-qpm4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-78"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.6.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "streambert", "source": "cna", "vendor": "truelockmc"}, "product": "streambert", "vendor": "truelockmc"}], "created": "2026-08-18T22:45:02.976400+00:00", "updated": "2026-08-19T09:45:03.335069+00:00", "vendors": ["truelockmc", "truelockmc$PRODUCT$streambert"]}