Description

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal without validating its protocol. A compromised renderer can submit file: URIs or operating-system-specific custom schemes, causing the host to open local files, access remote resources through registered handlers, or launch scripts and applications supported by those handlers. This issue is fixed in version 2.6.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-18T22:16:54.520Z",
  "pubdate": "2026-08-18T22:16:54.520Z",
  "executiveSummary": "An arbitrary URL opening vulnerability exists within the Streambert cross-platform Electron Desktop App prior to version 2.6.0. The vulnerability resides in the open-external IPC handler located at src/ipc/downloads.js, which fails to validate the protocol of a renderer-supplied url before passing it directly to Electron's shell.openExternal function. This security oversight allows a compromised renderer process to abuse the host operating system by submitting file: URIs or operating-system-specific custom schemes. The resulting impact includes the unauthorized opening of local files, access to remote resources via registered protocol handlers, and the execution of scripts or local applications supported by those handlers. The risk implications are severe, as an attacker with control over the renderer process can escalate privileges to execute arbitrary system commands or exfiltrate sensitive local data. Exploitation requires a compromised renderer process capable of invoking the vulnerable IPC handler with a crafted payload. Mitigation is achieved by upgrading the Streambert application to version 2.6.0, which resolves the issue by properly validating and restricting the protocols passed to the external handler.",
  "technicalDetails": "The vulnerability is caused by improper input validation within the Electron Inter-Process Communication (IPC) architecture of the Streambert application. Specifically, the vulnerable component is the open-external IPC handler implemented in the source file src/ipc/downloads.js. In versions prior to 2.6.0, this handler receives a url parameter directly from the renderer process without performing any sanitization or protocol validation checks. This untrusted input is then passed directly to Electron's shell.openExternal API.\nBecause the renderer process handles web content and media streams, it represents a high-risk attack surface. If an attacker successfully compromises the renderer process—for example, through cross-site scripting (XSS) or malicious content injection—they gain the ability to invoke available IPC handlers. The attacker crafts a malicious payload utilizing restricted or dangerous protocols, such as file: URIs or custom operating-system-specific schemes. When the compromised renderer submits this payload via the vulnerable IPC handler, the host operating system processes the request through shell.openExternal.\nThe step-by-step attack flow proceeds as follows: First, the attacker compromises the renderer process of the Streambert application. Second, the attacker formulates an IPC message targeting the open-external handler in src/ipc/downloads.js, supplying a malicious protocol URI as the url argument. Third, the backend Node.js main process receives the unsanitized url and passes it directly to shell.openExternal without restriction. Fourth, the operating system executes the handler associated with the supplied scheme, resulting in the opening of local files, retrieval of sensitive remote resources through registered handlers, or the launching of locally installed applications and scripts supported by those custom schemes.\nThe affected versions include all Streambert desktop application releases prior to version 2.6.0. Authentication and privilege requirements are minimal from the perspective of the renderer process, as it operates within the context of the running application instance. Network exposure is local to the host system executing the Electron desktop client, but payload behavior can trigger outbound connections or local command execution depending on the abused protocol scheme."
}