Streambert, a cross‑platform Electron desktop application, contains an IPC handler that accepts a renderer‑controlled filePath without validating its type or location. When the mpv or VLC launch attempts are skipped or fail, the handler passes the arbitrary filePath to Electron's shell.openPath. This allows a compromised renderer to provide a path to any local executable, script, shortcut, or file with an executable default handler, causing the operating system to launch it with the privileges of the Streambert process and facilitating escape from the renderer sandbox. The flaw is an instance of CWE‑20 (Unvalidated Input) and CWE‑78 (OS Command Injection).

The affected product is Streambert by truelockmc, an Electron‑based streaming and download client. All releases prior to version 2.6.0 are vulnerable; the issue was fixed in release 2.6.0.

The CVSS score of 8.8 indicates high severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV. The likely attack vector is local; an attacker with the ability to influence the renderer process (for example, via a malicious plugin or by compromising a user) can supply a malicious file path. Successful exploitation leads to arbitrary local code execution with the same privileges as the Streambert process and may enable further local privilege escalation.