CVE-2026-52877

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal without validating its protocol. A compromised renderer can submit file: URIs or operating-system-specific custom schemes, causing the host to open local files, access remote resources through registered handlers, or launch scripts and applications supported by those handlers. This issue is fixed in version 2.6.0.

• CWE-20
• CWE-749

• https://github.com/truelockmc/streambert/commit/8fd7eb1d358d1d69e57e51ddfa71b066b44ff616
• https://github.com/truelockmc/streambert/releases/tag/2.6.0
• https://github.com/truelockmc/streambert/security/advisories/GHSA-j2vw-gg3g-wwqr
• https://github.com/truelockmc/streambert/security/advisories/GHSA-j2vw-gg3g-wwqr

Published

Aug 18, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5287Use after free in PDF in Google Chrome prior to 146.0.7680.1…8.8
• CVE-2026-52870The MCP Python SDK, called mcp on PyPI, is a Python implemen…7.6
• CVE-2026-52872Streambert is a cross-platform Electron Desktop App to strea…8.8
• CVE-2026-52873Streambert is a cross-platform Electron Desktop App to strea…6.9
• CVE-2026-52875Streambert is a cross-platform Electron Desktop App to strea…8.4
• CVE-2026-52876Streambert is a cross-platform Electron Desktop App to strea…8.8
• CVE-2026-52878Klever-Go is the Go implementation of the Klever blockchain …7.5
• CVE-2026-52879Klever-Go is the Go implementation of the Klever blockchain …7.5
• CVE-2026-5288Use after free in WebView in Google Chrome on Android prior …9.6
• CVE-2026-52880Klever-Go is the Go implementation of the Klever blockchain …7.5
• CVE-2026-52884Notepad++ is a free and open-source source code editor. In v…7.8
• CVE-2026-52885Notepad++ is a free and open-source source code editor. Prio…6.3