CyberRota Analysis
AI-GeneratedThe open-external IPC handler in Streambert versions prior to 2.6.0 is vulnerable to unvalidated input, allowing a compromised renderer to execute arbitrary file URIs or custom schemes. This can lead to unauthorized access to local files, execution of scripts, or launching applications, posing a significant risk to system integrity. Users and administrators of Streambert should prioritize upgrading to version 2.6.0 to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to version 2.6.0, the open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal without validating its protocol. A compromised renderer can submit file: URIs or operating-system-specific custom schemes, causing the host to open local files, access remote resources through registered handlers, or launch scripts and applications supported by those handlers. This issue is fixed in version 2.6.0.