CVE-2026-52872 truelockmc CVE debrief

Who should care

Defenders responsible for Streambert installations, particularly those handling sensitive data or concerned with local file security, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-52872 is a high-severity vulnerability in Streambert that allows a compromised renderer to expose sensitive local data and overwrite files. Defenders should verify exposure, prioritize remediation, and restrict use of the run-download IPC channel.

• Sensitive local data exposure risk
• Potential overwrite of existing writable files
• Requires verification of Streambert version and exposure
• Remediation priority for Streambert installations

Technical summary

The downloadSubtitleFile utility in Streambert's src/ipc/downloads.js accepts a renderer-supplied subtitle URL using the file: URI scheme and passes its decoded pathname to fs.copyFileSync. A compromised renderer can exploit this to copy arbitrary readable files into an attacker-chosen writable location, exposing sensitive local data and overwriting existing writable files. This vulnerability allows a compromised renderer to potentially expose sensitive local data and overwrite existing files. The issue was fixed in version 2.5.0.

Defensive priority

Defenders should prioritize verifying exposure of Streambert installations to this vulnerability and upgrading to version 2.5.0 or later. Sensitive data exposure and file overwrite risks require immediate attention.

Recommended defensive actions

• Verify Streambert installations for exposure to this vulnerability
• Upgrade Streambert to version 2.5.0 or later
• Review and restrict use of the run-download IPC channel
• Monitor for suspicious file access and modifications
• Confirm whether affected Streambert deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed Streambert systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed Streambert assets that need extra review

Evidence notes

The vulnerability is confirmed in Streambert versions prior to 2.5.0. The issue involves the downloadSubtitleFile utility in src/ipc/downloads.js, which can be exploited through the run-download IPC channel. The fix is confirmed in version 2.5.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.