CVE-2026-52872

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its decoded pathname to fs.copyFileSync. The renderer also controls downloadPath, which determines the destination path. A compromised renderer can therefore copy any file readable by the StreamBERT process into an attacker-chosen writable location, exposing sensitive local data, and can overwrite existing writable files. This vulnerability is fixed in 2.5.0.

• CWE-22
• CWE-73

• https://github.com/truelockmc/streambert/security/advisories/GHSA-v74h-2468-rxhh
• https://github.com/truelockmc/streambert/security/advisories/GHSA-v74h-2468-rxhh

Published

Aug 18, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-52865When NGINX Ingress Controller processes Ingress or Transport…7.1
• CVE-2026-52866An attacker within BLE communication range can monopolize th…7.1
• CVE-2026-52868An unauthenticated attacker can read worklist records from a…8.8
• CVE-2026-52869The MCP Python SDK, called mcp on PyPI, is a Python implemen…7.1
• CVE-2026-5287Use after free in PDF in Google Chrome prior to 146.0.7680.1…8.8
• CVE-2026-52870The MCP Python SDK, called mcp on PyPI, is a Python implemen…7.6
• CVE-2026-52873Streambert is a cross-platform Electron Desktop App to strea…6.9
• CVE-2026-52875Streambert is a cross-platform Electron Desktop App to strea…8.4
• CVE-2026-52876Streambert is a cross-platform Electron Desktop App to strea…8.8
• CVE-2026-52877Streambert is a cross-platform Electron Desktop App to strea…8.3
• CVE-2026-52878Klever-Go is the Go implementation of the Klever blockchain …7.5
• CVE-2026-52879Klever-Go is the Go implementation of the Klever blockchain …7.5