CVE-2026-52876 truelockmc CVE debrief

Who should care

Defenders managing Electron applications or systems with Streambert installed should assess exposure to this vulnerability. Immediate action is required to verify if systems are vulnerable and to apply the fix.

Why it matters

CVE-2026-52876 is a high-severity vulnerability in Streambert that allows a compromised renderer to launch local executables or scripts with elevated privileges, enabling escape from the renderer sandbox. Defenders should prioritize assessing exposure, verifying vulnerability, and applying the fix.

• Potential elevation of privileges for a compromised renderer.
• Possible execution of local executables or scripts with elevated privileges.
• Escape from the renderer sandbox.

Technical summary

The open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location. If mpv or VLC launch attempts are skipped or fail, the handler passes filePath to Electron's shell.openPath, potentially allowing a compromised renderer to launch local executables or scripts with elevated privileges. This vulnerability exists in versions prior to 2.6.0 and has been fixed in version 2.6.0. The vulnerability allows a compromised renderer to launch local executables or scripts with the privileges of the StreamBERT process, enabling escape from the renderer sandbox.

Defensive priority

Defenders should prioritize assessing exposure to this vulnerability, especially those managing Electron applications or systems with Streambert installed. Immediate action is required to verify if systems are vulnerable and to apply the fix.

Recommended defensive actions

• Assess exposure to this vulnerability, especially for Electron applications or systems with Streambert installed.
• Verify if systems are vulnerable and apply the fix (version 2.6.0 or later).
• Monitor systems for potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability details are based on the CVE and NVD records, as well as source references from GitHub. The information provided by these sources indicates that the vulnerability exists in versions prior to 2.6.0 and that it has been fixed in version 2.6.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.