Description

Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC handler in index.js creates the partition:wyzie-redeem Electron session and registers an onHeadersReceived hook that removes the Content-Security-Policy header from every response in that session. The redeem window also lacks a setWindowOpenHandler restriction, so script injection in sub.wyzie.io, a loaded third-party resource, or a site reached through navigation executes without CSP constraints and can affect additional windows and persistent session storage. A user must open the Wyzie API key redemption window, and exploitation requires attacker-controlled script content in a loaded page. The resulting renderer script can invoke renderer-exposed application functionality and can be chained with other vulnerabilities to access internal services or sensitive data. This issue is fixed in version 2.6.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.9",
  "pubDate": "2026-08-18T22:16:53.830Z",
  "pubdate": "2026-08-18T22:16:53.830Z",
  "executiveSummary": "Streambert versions 2.5.0 through 2.6.0 contain a security vulnerability involving the wyzie-open-redeem IPC handler in index.js, which improperly strips Content-Security-Policy headers from network responses.\nThe vulnerability affects the partition:wyzie-redeem Electron session and the associated redeem window, which also lacks a setWindowOpenHandler restriction.\nThe impact allows script injection originating from sub.wyzie.io, loaded third-party resources, or navigated sites to execute without Content-Security-Policy constraints.\nThis can adversely affect additional application windows and persistent session storage, potentially leading to arbitrary renderer script execution and access to internal services or sensitive data when chained with other vulnerabilities.\nExploitation requires user interaction via opening the Wyzie API key redemption window and attacker-controlled script content within a loaded page.",
  "technicalDetails": "The root cause of the vulnerability resides in index.js within the wyzie-open-redeem Inter-Process Communication handler.\nUpon invocation, the handler creates the partition:wyzie-redeem Electron session and registers an onHeadersReceived lifecycle hook.\nThis hook programmatically removes the Content-Security-Policy header from every HTTP response processed within that specific session.\nFurthermore, the redeem window implementation lacks a setWindowOpenHandler restriction, failing to enforce proper navigation and popup controls.\nThe attack flow proceeds as follows: First, a user must explicitly open the Wyzie API key redemption window within Streambert.\nSecond, an attacker leverages attacker-controlled script content present in a loaded page, a third-party resource, or sub.wyzie.io reached through navigation.\nBecause the Content-Security-Policy header has been stripped from the session responses, the injected or malicious script executes completely devoid of CSP security constraints.\nOnce executing within the renderer context, the resulting script can invoke renderer-exposed application functionality.\nPost-exploitation impact includes the potential to affect additional application windows, compromise persistent session storage, and chain with other vulnerabilities to access internal services or sensitive data.\nThe vulnerable component is the wyzie-open-redeem IPC handler in index.js across affected versions 2.5.0 up to version 2.6.0."
}