CVE-2026-52873: Streambert Electron App XSS Vulnerability

CVE-2026-52873 Overview

CVE-2026-52873 is a script injection vulnerability in Streambert, a cross-platform Electron desktop application for streaming and downloading video content. The flaw exists in the wyzie-open-redeem inter-process communication (IPC) handler inside index.js. This handler creates the partition:wyzie-redeem Electron session and registers an onHeadersReceived hook that strips the Content-Security-Policy (CSP) header from every response in that session. The redeem window also lacks a setWindowOpenHandler restriction. Attacker-controlled script content loaded through sub.wyzie.io, third-party resources, or navigated pages executes without CSP constraints. The vulnerability affects Streambert versions 2.5.0 through 2.5.x and is fixed in version 2.6.0.

Critical Impact
Renderer script injection in the Wyzie redemption window can invoke exposed application functionality, affect additional windows, and read persistent session storage, enabling chained attacks against internal services or sensitive data.

Affected Products

Streambert Electron Desktop Application version 2.5.0
Streambert versions 2.5.x prior to 2.6.0
The wyzie-open-redeem IPC handler in index.js

Discovery Timeline

2026-08-18 - CVE-2026-52873 published to NVD
2026-08-18 - Last updated in NVD database
Streambert 2.6.0 - Vendor releases patched version resolving the issue

Technical Details for CVE-2026-52873

Vulnerability Analysis

The vulnerability is a Cross-Site Scripting (XSS) class flaw [CWE-79] caused by intentional removal of the Content-Security-Policy header within a dedicated Electron session. Streambert defines an IPC handler named wyzie-open-redeem that opens a redemption window for Wyzie API keys. To load the third-party redemption interface, the handler registers a session-level onHeadersReceived hook that deletes the CSP response header on every request in the partition:wyzie-redeem session. Removing CSP eliminates the browser-level defense that would otherwise restrict inline script execution and cross-origin script sources.

The redeem BrowserWindow also omits a setWindowOpenHandler restriction. Any window opened from the redeem context inherits the same permissive configuration and can navigate freely. Persistent session storage in the partition means that data written by injected scripts survives across window lifetimes.

Root Cause

The root cause is unsafe manipulation of security response headers combined with a missing window creation policy. Removing CSP for every response in the session neutralizes the primary defense against script injection in a loaded third-party origin. The absence of a setWindowOpenHandler allows child windows to be created and navigated without additional constraint, extending the attack surface across the session partition.

Attack Vector

Exploitation requires user interaction. A user must open the Wyzie API key redemption window from the Streambert settings interface. An attacker must also control script content in a page reachable from that window, either through sub.wyzie.io, a loaded third-party resource, or a navigation destination. Once loaded, the injected script executes in the renderer without CSP restrictions. The script can invoke renderer-exposed application functionality through the preload bridge and can be chained with other vulnerabilities to reach internal services or extract sensitive data from persistent storage.

javascript

// Patch excerpt from index.js (Source: GitHub commit 0bd6b6c)
     minWidth: 900,
     minHeight: 600,
     backgroundColor: "#0a0a0a",
-    icon: process.platform === "linux"
-      ? path.join(__dirname, "public/sized/256x256.png")
-      : undefined,
+    icon:
+      process.platform === "linux"
+        ? path.join(__dirname, "public/sized/256x256.png")
+        : undefined,
     titleBarStyle: process.platform === "darwin" ? "hiddenInset" : "hidden",
     frame: process.platform !== "win32",
     webPreferences: {
// Source: https://github.com/truelockmc/streambert/commit/0bd6b6ca8c830f22f75de1aa2e0d8b9bdf6d34c7

Detection Methods for CVE-2026-52873

Indicators of Compromise

Streambert installations running versions between 2.5.0 and 2.5.x where the wyzie-open-redeem IPC handler is present in index.js.
Electron sessions using partition:wyzie-redeem with an onHeadersReceived hook that deletes Content-Security-Policy headers.
Unexpected child windows spawned from the Wyzie redemption window navigating to non-Wyzie origins.

Detection Strategies

Audit the Streambert index.js source for calls that mutate response headers in the partition:wyzie-redeem session and confirm removal of any CSP-stripping logic.
Monitor endpoint process telemetry for the Streambert renderer process making outbound network connections to origins other than sub.wyzie.io while the redeem window is active.
Inspect Electron webRequest logs, where available, for onHeadersReceived modifications that remove security headers.

Monitoring Recommendations

Track application version distribution across managed endpoints and flag Streambert installations below version 2.6.0.
Alert on script execution or subprocess creation originating from the Streambert renderer that deviates from baseline application behavior.
Log DNS resolution for sub.wyzie.io and any redirects served through the redeem window for post-incident review.

How to Mitigate CVE-2026-52873

Immediate Actions Required

Upgrade Streambert to version 2.6.0 or later, which removes the CSP-stripping behavior and restores default header enforcement in the redeem session.
Instruct users to avoid opening the Wyzie API key redemption window until the upgrade is completed on affected endpoints.
Inventory endpoints running Streambert 2.5.0 through 2.5.x and prioritize patch deployment for users who redeem Wyzie API keys.

Patch Information

The issue is fixed in Streambert version 2.6.0. The vendor patch is tracked in GitHub commit 0bd6b6c and Pull Request #126. The release is published at Streambert 2.6.0. See the GHSA-2j2q-qvpf-wh43 advisory for the full vendor description.

Workarounds

Do not open the Wyzie API key redemption window on affected versions; redeem keys through an alternative channel if available.
Restrict outbound network access from the Streambert application to only required Wyzie endpoints using host-based firewall rules.
Remove or clear the partition:wyzie-redeem persistent session storage after any use to limit data persistence across sessions.

bash

# Verify installed Streambert version and confirm patched build
# Linux example
streambert --version

# Windows PowerShell example
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Streambert*" } |
  Select-Object DisplayName, DisplayVersion

# Required minimum version: 2.6.0