Streambert versions prior to 2.6.0 contain an input validation flaw in the open-external IPC handler located in src/ipc/downloads.js. The handler forwards renderer-supplied URLs directly to Electron's shell.openExternal without validating the protocol. This allows an attacker controlling the renderer process to supply file: URIs or OS-specific custom schemes, which can cause the host system to open local files, access remote resources through registered handlers, or execute scripts and applications supported by those handlers. The vulnerability is addressed in Streambert version 2.6.0.

An attacker who compromises the renderer process can exploit this vulnerability to cause the host system to open local files or launch external applications without user consent. This can lead to information disclosure, integrity violations, and availability impacts on the affected system. The CVSS v3.1 score is 8.3, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts to confidentiality, integrity, and availability.

Upgrade Streambert to version 2.6.0 or later, where the open-external IPC handler validates URL protocols before passing them to Electron's shell.openExternal. No other mitigation is indicated by the vendor advisory.