Streambert, a cross‑platform Electron desktop application, uses an IPC handler that accepts a filePath supplied by its renderer process without validating the file type or its location. If the application’s attempts to launch these media files with mpv or VLC are skipped or fail, the handler forwards that unvalidated filePath to Electron’s shell.openPath. An attacker who can influence the renderer—such as through a malicious plug‑in or compromised user input—can provide a path to a local executable, script, shortcut, or other file that the operating system will open with Streambert’s privileges. This abuse allows arbitrary local code execution and breaks the isolation between Streambert’s renderer and main processes.

The vendor truelockmc’s Streambert application is affected, and every release prior to version 2.6.0 contains this flaw. The issue was addressed in the 2.6.0 release, which performs proper validation before delegating to shell.openPath.

The CVSS score of 8.8 indicates high severity. The EPSS score is unavailable and the vulnerability is not listed in CISA KEV. The likely attack vector is local; an attacker who can tamper with the renderer, such as via a malicious plug‑in or by supplying a crafted file path, can trigger execution of arbitrary code with the same privileges as the Streambert process, potentially enabling further local privilege escalation.