CVE-2026-52876: Streambert Path Traversal Vulnerability

CVE-2026-52876 Overview

CVE-2026-52876 affects Streambert, a cross-platform Electron desktop application for streaming and downloading video content. The open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath argument without validating its type or filesystem location. When the mpv or VLC launch attempts are skipped or fail, the handler passes the attacker-controlled path directly to Electron's shell.openPath. A compromised renderer can supply the path of a local executable, script, or shortcut, causing the operating system to launch it with the privileges of the Streambert process. The flaw enables escape from the renderer sandbox and is fixed in version 2.6.0.

Critical Impact
A compromised renderer process can execute arbitrary local files with the privileges of the Streambert process, bypassing the Electron sandbox.

Affected Products

Streambert Electron Desktop App versions prior to 2.6.0
All platforms supported by Streambert (Windows, macOS, Linux)
Deployments relying on Electron's renderer sandbox for isolation

Discovery Timeline

2026-08-18 - CVE-2026-52876 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-52876

Vulnerability Analysis

Streambert exposes an open-path-at-time IPC handler in src/ipc/player.js that is designed to open media files in an external player at a specific timestamp. The handler receives a filePath value from the renderer process and attempts to launch mpv or VLC with that path. When both launch attempts are skipped or fail, the handler falls back to shell.openPath(filePath). Electron's shell.openPath invokes the operating system's default handler for the file type, which for executables, scripts, or shortcuts results in immediate program execution. The vulnerability is classified as improper input validation [CWE-20].

Root Cause

The handler performs no type checking or path validation on the renderer-supplied filePath. There is no allowlist of media file extensions, no absolute-path normalization, and no rejection of executables, scripts, or symlinks. Any string the renderer supplies flows into shell.openPath, delegating execution to the host operating system.

Attack Vector

An attacker who compromises the renderer, for example through a cross-site scripting flaw in embedded web content or a malicious remote source, sends a crafted IPC message with filePath pointing to a local executable, .bat, .sh, .lnk, or other file with an executing default handler. When the mpv and VLC launch paths fail or are skipped, shell.openPath triggers the OS to run the file with the privileges of the Streambert main process, escaping the renderer sandbox.

javascript

// Patch excerpt from src/ipc/player.js introducing allow-list validation
// Source: https://github.com/truelockmc/streambert/commit/43566ed031183b046675761c9813c5379b619269

function register(getMainWindow, { writeSecretMigration }) {
  // ── Open file at specific timestamp in mpv / VLC ─────────────────────────

  // Extensions considered safe to pass to an external media player.
  // This also gates the shell.openPath fallback.
  const ALLOWED_MEDIA_EXTENSIONS = new Set([
    ".mp4",
    ".mkv",
    ".avi",
    ".mov",
    ".webm",
    ".m4v",
    ".ts",
    ".m2ts",
    ".m3u8",
  ]);

  const ALLOWED_SUBTITLE_EXTENSIONS = new Set([
    ".srt",
    ".ass",
    ".ssa",
    ".vtt",
    ".sub",
    ".idx",
    ".sup",
  ]);

  // Validate a path: must have an allowed extension and must resolve to a
  // real absolute path (prevents path-traversal tricks like "../../bin/sh").
}

Source: GitHub Commit 43566ed

Detection Methods for CVE-2026-52876

Indicators of Compromise

Streambert child processes spawning non-media binaries such as cmd.exe, powershell.exe, bash, sh, or wscript.exe
IPC calls to open-path-at-time referencing files with non-media extensions like .exe, .bat, .ps1, .sh, .lnk, or .js
Streambert installations at versions earlier than 2.6.0 running on user endpoints

Detection Strategies

Monitor process trees for the Streambert executable launching interpreters or executables outside the mpv and VLC binaries
Inspect renderer-to-main IPC traffic for filePath arguments that do not end in allowed media or subtitle extensions
Alert on shell.openPath invocations executing files from user-writable directories such as Downloads or Temp

Monitoring Recommendations

Track Streambert version deployments across managed endpoints and flag any host running a build older than 2.6.0
Enable command-line auditing on endpoints where Streambert is installed to capture child process arguments
Correlate Streambert child process events with recent network activity from the app to identify remote-triggered execution

How to Mitigate CVE-2026-52876

Immediate Actions Required

Upgrade all Streambert installations to version 2.6.0 or later, which introduces path type and extension validation
Inventory endpoints for vulnerable versions and prioritize systems where Streambert renders untrusted remote content
Restrict execution of Streambert on high-value hosts until patching is complete

Patch Information

The fix is available in Streambert 2.6.0. The patch adds ALLOWED_MEDIA_EXTENSIONS and ALLOWED_SUBTITLE_EXTENSIONS allowlists in src/ipc/player.js and requires paths to resolve to a real absolute path before being passed to any external player or shell.openPath. Related hardening in src/ipc/storage.js normalizes backup paths using path.resolve. Review the GitHub Security Advisory GHSA-85vf-2qwc-qpm4, Pull Request #149, and the 2.6.0 Release Notes.

Workarounds

Uninstall Streambert versions prior to 2.6.0 where immediate upgrade is not possible
Block outbound network access for Streambert to prevent renderer compromise from untrusted remote content
Apply operating system application control policies to deny execution of scripts and executables launched by the Streambert process

bash

# Verify installed Streambert version and upgrade path
streambert --version

# Example: remove pre-2.6.0 install on Linux, then install patched release
rm -rf ~/.local/share/streambert
# Download 2.6.0 from https://github.com/truelockmc/streambert/releases/tag/2.6.0