Description

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If the mpv or VLC launch attempts are skipped or fail, the handler passes filePath to Electron's shell.openPath. A compromised renderer can provide the path of a local executable, script, shortcut, or other file with an executing default handler, causing the operating system to launch it with the privileges of the StreamBERT process and enabling escape from the renderer sandbox. This issue is fixed in version 2.6.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T22:16:54.173Z",
  "pubdate": "2026-08-18T22:16:54.173Z",
  "executiveSummary": "Streambert prior to version 2.6.0 suffers from an arbitrary code execution vulnerability stemming from an insecure Inter-Process Communication (IPC) handler that improperly validates renderer-supplied file paths.\nSpecifically, the open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without type or location validation.\nIf media player launch attempts using mpv or VLC fail or are skipped, the application passes the unvalidated filePath directly to Electron's shell.openPath API.\nA compromised renderer process can exploit this behavior by supplying the path to a local executable, script, shortcut, or other file associated with an executing default handler on the host operating system.\nThis causes the operating system to execute the targeted file with the privileges of the main StreamBERT application process, effectively enabling a sandbox escape from the isolated renderer context to the host system.\nThe risk implication is severe, as successful exploitation results in full code execution on the underlying host machine under the security context of the desktop application user.\nThis vulnerability is fully remediated in version 2.6.0 through proper input validation and path restriction within the affected IPC handler.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure handling of Inter-Process Communication (IPC) messages within the Electron desktop application framework, specifically inside the player component located at src/ipc/player.js.\nThe application implements an IPC handler named open-path-at-time designed to manage video playback workflows, which accepts a filePath parameter directly controlled by the untrusted renderer process.\nDuring normal execution, this handler attempts to launch external media players such as mpv or VLC using the provided path.\nHowever, if these launch attempts are intentionally skipped or fail for any reason, the control flow falls back to invoking Electron's shell.openPath function with the raw, unvalidated filePath.\nBecause the renderer process operates within a sandboxed environment but is susceptible to cross-site scripting (XSS) or logical compromise, an attacker who compromises the renderer can supply arbitrary file paths instead of legitimate media files.\nThe attack flow proceeds as follows: 1) The attacker achieves code execution within the renderer process; 2) The attacker invokes the open-path-at-time IPC message, passing a malicious payload path pointing to a local executable, batch script, malicious shortcut, or document with an active default handler; 3) The main process receives the IPC message and triggers the fallback mechanism due to a simulated or actual media player failure; 4) The main process executes shell.openPath(filePath) without validating whether the path resides within expected directories or possesses a safe file extension.\nElectron's shell.openPath instructs the underlying host operating system to open the specified file using its default registered application.\nFor executable files, scripts, or registered file types, the operating system launches the resource directly.\nBecause shell.openPath runs within the context of the main Electron process, the payload inherits the full privileges of the StreamBERT application on the host system, bypassing the Chromium renderer sandbox entirely.\nThis vulnerability affects Streambert versions prior to 2.6.0.\nNo network exposure or authentication is required for exploitation, as the attack vector relies purely on internal IPC communication channels accessible from a compromised local renderer process."
}