CVE-2026-52877

Name of the Vulnerable Software and Affected Versions Streambert versions prior to 2.6.0

Description Streambert is a cross-platform Electron Desktop App used for streaming and downloading video content. The open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal() function without validating the protocol. A compromised renderer can submit file: URIs or operating-system-specific custom schemes, allowing the host to open local files, access remote resources through registered handlers, or launch scripts and applications supported by those handlers.

Recommendations Update to version 2.6.0.