Description

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its decoded pathname to fs.copyFileSync. The renderer also controls downloadPath, which determines the destination path. A compromised renderer can therefore copy any file readable by the StreamBERT process into an attacker-chosen writable location, exposing sensitive local data, and can overwrite existing writable files. This vulnerability is fixed in 2.5.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T22:16:53.650Z",
  "pubdate": "2026-08-18T22:16:53.650Z",
  "executiveSummary": "An arbitrary file copy vulnerability exists in the Streambert cross-platform Electron Desktop App prior to version 2.5.0. The flaw resides within the IPC communication layer, specifically in the downloadSubtitleFile utility located in src/ipc/downloads.js and triggered via the run-download IPC channel. This security defect allows a compromised renderer process to supply arbitrary file: URI schemes and control the destination downloadPath. Consequently, an attacker can leverage this mechanism to read sensitive local files accessible to the StreamBERT process and write them to arbitrary attacker-controlled locations, as well as overwrite existing writable files on the host system. The risk implication is significant as it enables local data exposure and file tampering. Exploitation requires a compromised renderer process capable of interacting with the IPC channel. The vulnerability has been addressed and officially resolved in version 2.5.0.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and sanitization within the IPC message handling logic of the Streambert application. Specifically, the downloadSubtitleFile utility within src/ipc/downloads.js processes subtitle URLs received directly from the renderer process via the run-download IPC channel without adequately restricting the allowed URI schemes.\nThe vulnerable function parses renderer-supplied URLs and accepts the file: URI scheme, subsequently decoding the pathname and passing it directly to the Node.js filesystem operation fs.copyFileSync. Furthermore, the renderer process retains control over the downloadPath parameter, which dictates the destination directory and filename for the copy operation.\nThe attack flow proceeds as follows: First, an attacker compromises or leverages execution within the renderer process. Second, the attacker invokes the run-download IPC channel, supplying a specially crafted payload where the source subtitle URL utilizes the file: URI scheme pointing to a sensitive local file readable by the privileged StreamBERT main process. Third, the attacker specifies a target destination via the downloadPath parameter pointing to a writable location.\nUpon receiving the IPC message, the main process executes fs.copyFileSync using the attacker-controlled source path and destination path. This results in the arbitrary copying of local system files to attacker-accessible locations. Additionally, because the destination path is controlled by the renderer, the vulnerability can be leveraged to overwrite existing writable files on the host filesystem.\nThe affected component is the downloadSubtitleFile utility located in src/ipc/downloads.js, specifically affecting all Streambert versions prior to 2.5.0. Exploitation relies on renderer process compromise, requiring no specialized network exposure or external authentication, but successfully achieves unauthorized data exfiltration and local file modification within the context of the running application process."
}