Executive brief
Streambert is a cross-platform desktop application for streaming and downloading video content. A critical vulnerability in its auto-update mechanism allows a compromised renderer process to inject an arbitrary URL, causing the application to download and execute malicious software with full system privileges, leading to complete system compromise.
Technical details
The vulnerability exists in the IPC handler "download-and-install-update" (src/ipc/player.js) which accepts a user-controlled URL parameter from the renderer process without validation. An attacker who can compromise the renderer process (via XSS or untrusted content) can invoke this handler with a malicious URL pointing to an attacker-controlled binary. The application then downloads and automatically executes this binary using spawn(). The vulnerability requires compromising the renderer process first, but provides a direct path from renderer context to arbitrary code execution with application privileges. Version 2.5.0 patches the issue by restricting downloads to the official GitHub release URL using a trusted prefix whitelist.
Affected products
- truelockmc Streambert <2.5.0
Timeline
- 2026-05-22: disclosed: GHSA-vj74-r9xm-37mj advisory published; vulnerability discovered by jeremyHOT
- 2026-05-22: patched: Version 2.5.0 released with patch implementing URL whitelist validation