CVE-2026-52877: Streambert Electron App SSRF Vulnerability

CVE-2026-52877 Overview

CVE-2026-52877 affects Streambert, a cross-platform Electron desktop application for streaming and downloading video content. The open-external IPC handler in src/ipc/downloads.js forwards a renderer-supplied URL directly to Electron's shell.openExternal without validating the protocol. A compromised renderer can submit file: URIs or operating-system-specific custom schemes. This lets the host open local files, reach remote resources through registered handlers, or launch scripts and applications tied to those handlers. The issue is resolved in Streambert version 2.6.0. The flaw is tracked as an improper input validation weakness [CWE-20].

Critical Impact
A compromised renderer process can trigger arbitrary local file access and launch external applications via unvalidated URI schemes passed to shell.openExternal.

Affected Products

Streambert Electron Desktop Application
Streambert versions prior to 2.6.0
src/ipc/downloads.js open-external IPC handler

Discovery Timeline

2026-08-18 - CVE-2026-52877 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-52877

Vulnerability Analysis

Streambert exposes an IPC channel named open-external that main-process code registers with ipcMain.handle. The handler receives a URL argument from the renderer and calls shell.openExternal(url) without any protocol filtering. Electron's shell.openExternal delegates to the operating system's default handler for the given URI scheme. When the input is not restricted to safe web protocols, the host can be coerced into invoking arbitrary registered handlers.

Exploitation requires a renderer compromise, such as a stored cross-site scripting payload in downloaded content or a malicious page rendered inside the app. Once the renderer is under attacker control, invoking the IPC channel with a file: URI causes the host to open local files. Operating-system-specific schemes, such as ms-msdt:, search-ms:, or custom application handlers, can launch external programs or trigger command execution paths supported by the shell.

Root Cause

The root cause is missing input validation on a privileged IPC boundary. The handler treats the renderer as a trusted source and does not enforce an allow-list of protocols before invoking shell.openExternal.

Attack Vector

The attack vector is network-adjacent through the renderer process. An attacker who can execute code or inject content in the renderer sends a crafted URL over the open-external IPC channel. The main process then invokes the OS handler for that scheme.

javascript

// Security patch in src/ipc/downloads.js
//   });

  ipcMain.handle("open-external", (_, url) => {
-    shell.openExternal(url);
+    try {
+      const parsed = new URL(url);
+      if (parsed.protocol === "http:" || parsed.protocol === "https:") {
+        shell.openExternal(url);
+      }
+    } catch {}
  });
  ipcMain.handle("open-path", (_, filePath) => {
    // If the path points to a file (e.g. an .asar archive or an executable),

Source: GitHub Commit 8fd7eb1

The patch parses the incoming URL and restricts execution to http: and https: protocols. Any other scheme, or a value that fails to parse, is silently dropped.

Detection Methods for CVE-2026-52877

Indicators of Compromise

Streambert processes spawning unexpected child processes such as cmd.exe, powershell.exe, bash, or handler binaries linked to custom URI schemes.
File access telemetry showing the Streambert main process reading sensitive local paths shortly after renderer activity.
Renderer-side JavaScript invoking ipcRenderer.invoke("open-external", ...) with non-HTTP schemes such as file:, ms-msdt:, or search-ms:.

Detection Strategies

Inventory installed Streambert versions across endpoints and flag any build earlier than 2.6.0.
Hunt for process trees where the Streambert executable is the parent of shell interpreters or scripting hosts.
Inspect Streambert application logs and Electron crash dumps for suspicious URL arguments passed to open-external.

Monitoring Recommendations

Enable endpoint process-lineage telemetry to correlate Electron main-process activity with child process launches.
Monitor local file reads originating from the Streambert process against a baseline of expected media directories.
Alert on outbound network connections initiated by handler binaries invoked shortly after Streambert activity.

How to Mitigate CVE-2026-52877

Immediate Actions Required

Upgrade all Streambert installations to version 2.6.0 or later, which enforces protocol allow-listing in the open-external handler.
Restrict execution of Streambert on high-value endpoints until the patched build is deployed.
Review recent Streambert usage for renderer-side content that could carry injected payloads.

Patch Information

The fix is available in Streambert Release 2.6.0. The corresponding source change is documented in commit 8fd7eb1 and the GitHub Security Advisory GHSA-j2vw-gg3g-wwqr.

Workarounds

If patching is delayed, block the Streambert binary from launching child processes using application control policies.
Restrict Streambert accounts from accessing sensitive file paths via operating-system-level access controls.
Disable or remove risky URI scheme handlers such as ms-msdt: and search-ms: on Windows endpoints.

bash

# Verify installed Streambert version and enforce minimum patched build
streambert --version
# Expected output: 2.6.0 or later

# Windows: remove a risky URI handler as a defense-in-depth workaround
reg delete "HKEY_CLASSES_ROOT\ms-msdt" /f