CVE-2026-52873— true_lock Streambert 处理逻辑错误漏洞

Streambert: Global CSP Removal in Wyzie Redeem Window Enables Unconstrained XSS in Electron Renderer

Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC handler in index.js creates the partition:wyzie-redeem Electron session and registers an onHeadersReceived hook that removes the Content-Security-Policy header from every response in that session. The redeem window also lacks a setWindowOpenHandler restriction, so script injection in sub.wyzie.io, a loaded third-party resource, or a site reached through navigation executes without CSP constraints and can affect additional windows and persistent session storage. A user must open the Wyzie API key redemption window, and exploitation requires attacker-controlled script content in a loaded page. The resulting renderer script can invoke renderer-exposed application functionality and can be chained with other vulnerabilities to access internal services or sensitive data. This issue is fixed in version 2.6.0.

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

true_lock Streambert 处理逻辑错误漏洞

true_lock Streambert是德国true_lock个人开发者的一款跨平台的 Electron 桌面应用。 true_lock Streambert 2.5.0版本至2.6.0之前版本存在安全漏洞，该漏洞源于wyzie-open-redeem IPC处理程序移除Content-Security-Policy标头且缺少setWindowOpenHandler限制，可能导致脚本注入，从而影响其他窗口和持久会话存储，并可能访问内部服务或敏感数据。

N/A

N/A