CVE-2026-48056Arbitrary binary execution in Streambert (Electron)
Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the run-download IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s privileges. Version 2.5.0 contains a patch.
View on NVDAnalysis
Streambert, una aplicación de escritorio basada en Electron, permite la ejecución de binarios locales arbitrarios debido a una validación insuficiente en el manejador IPC run-download. Un proceso de renderizado comprometido puede escalar privilegios y ejecutar código con los permisos de la aplicación en el sistema anfitrión. Es imperativo actualizar a la versión 2.5.0 para corregir esta falla crítica de seguridad.
Relevant roles
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HCWE-20CWE-749EPSS
No EPSS score yet (CVE may be too fresh).
Technical description
Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the run-download IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s privileges. Version 2.5.0 contains a patch.