The vulnerability is in Streambert’s open‑external IPC handler, which forwards a renderer‑supplied URL directly to Electron’s shell.openExternal without first validating the protocol. Because the protocol is unchecked, a malicious renderer can provide file: URIs or operating‑system‑specific custom schemes, causing the host machine to open local files, request remote resources via registered handlers, or launch scripts and applications associated with those schemes. This unchecked input is a classic example of CWE‑20 and permits the attacker to execute arbitrary code locally (CWE‑749). The primary consequence is that an attacker could run any code on the vulnerable system or exfiltrate local data.

All Streambert releases built before version 2.6.0 – including the 2.5.x series and earlier – are affected. The application is a cross‑platform Electron desktop client distributed by truelockmc. Users running any pre‑2.6.0 build are susceptible until they upgrade to the patched release.

The CVSS base score of 8.3 indicates high severity, but EPSS data is not available, so the exact likelihood of exploitation cannot be quantified. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker would need to compromise the renderer process or supply a malicious plugin that submits an unchecked URL to the IPC handler. Once that condition is met, the unchecked shell.openExternal call can be triggered, allowing local code execution and the potential for further system compromise.