The flaw resides in Streambert’s open‑external IPC handler. The handler forwards a URL supplied by the renderer directly to Electron’s shell.openExternal without first validating the protocol. Because the protocol is unchecked, a malicious renderer can provide file: URIs or operating‑system‑specific custom schemes, leading the host to open local files, access remote resources via registered handlers, or launch scripts and applications associated with those schemes. This flaw constitutes an unchecked input (CWE‑20) that permits the attacker to execute arbitrary local code (CWE‑749). The primary impact is that an attacker could run arbitrary code on the machine or exfiltrate local files.

All versions of Streambert build numbers before 2.6.0 are affected, including the 2.5.x and earlier releases. The product is a cross‑platform Electron desktop application distributed by truelockmc. Users running Streambert 2.5.0 or older are vulnerable until they upgrade to the patched 2.6.0 release.

The vulnerability scores high on the CVSS scale with a base score of 8.3, indicating a high‑severity potential. EPSS data is not available, so the precise exploit probability cannot be quantified, but the fact that the flaw permits local code execution places it in a candidate for exploitation when the application runs in a user’s environment. The weakness is not currently in the CISA KEV catalog, but its local exploitation pathway and lack of input validation make it a risk that should be mitigated promptly. The attack vector likely requires a compromised renderer process or a malicious plugin; once that is achieved, the unchecked shell.openExternal call can be triggered.