# CVE-2026-48046: Streambert unvalidated auto-updater URL injection in IPC handler

Source: https://junglewise.ai/threats/cve-2026-48046-streambert-unvalidated-auto-updater-url-injection-in-ipc-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-48046 · Severity: info · CVSS 9.3 · Published 2026-08-11

Streambert is a cross-platform desktop application for streaming and downloading video content. A critical vulnerability in its auto-update mechanism allows a compromised renderer process to inject an arbitrary URL, causing the application to download and execute malicious software with full system privileges, leading to complete system compromise.

Technologies: [Truelockmc Streambert](https://junglewise.ai/threats/technologies/streambert). Vendors: [Truelockmc](https://junglewise.ai/threats/vendors/truelockmc).

## Quick answers

**Is CVE-2026-48046 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48046 being exploited in the wild.

**How severe is CVE-2026-48046?** Informational severity, with a CVSS score of 9.3, published 11 August 2026.

**Which products and versions are affected?** Truelockmc Streambert <2.5.0.

**Is there a fix for CVE-2026-48046?** A patch was published on 2026-05-22: Version 2.5.0 released with patch implementing URL whitelist validation Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48046 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48046?** Check whether you run Truelockmc Streambert at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the IPC handler "download-and-install-update" (src/ipc/player.js) which accepts a user-controlled URL parameter from the renderer process without validation. An attacker who can compromise the renderer process (via XSS or untrusted content) can invoke this handler with a malicious URL pointing to an attacker-controlled binary. The application then downloads and automatically executes this binary using spawn(). The vulnerability requires compromising the renderer process first, but provides a direct path from renderer context to arbitrary code execution with application privileges. Version 2.5.0 patches the issue by restricting downloads to the official GitHub release URL using a trusted prefix whitelist.

## Affected products

- truelockmc Streambert <2.5.0

## Timeline

- 2026-05-22: disclosed: GHSA-vj74-r9xm-37mj advisory published; vulnerability discovered by jeremyHOT
- 2026-05-22: patched: Version 2.5.0 released with patch implementing URL whitelist validation

## References

- [https://github.com/truelockmc/streambert/releases/tag/2.5.0](https://github.com/truelockmc/streambert/releases/tag/2.5.0)
- [https://github.com/truelockmc/streambert/security/advisories/GHSA-vj74-r9xm-37mj](https://github.com/truelockmc/streambert/security/advisories/GHSA-vj74-r9xm-37mj)

## Related threats

- [Streambert arbitrary binary execution via downloader IPC handler](https://junglewise.ai/threats/cve-2026-48056-streambert-arbitrary-binary-execution-via-downloader-ipc-handler)
- [truelockmc Streambert Zip Slip in subtitle extraction](https://junglewise.ai/threats/cve-2026-48055-truelockmc-streambert-zip-slip-in-subtitle-extraction)