CVE-2026-123208: noname v1.11.2 through v1.11.6.1 Missing Authentication in Electron Local File Server

Published Nov 5, 2026

Updated

noname Electron desktop build v1.11.2 through v1.11.6.1 contains an unauthenticated local file server with wildcard CORS that allows malicious websites to read, overwrite, or delete installation files. Attackers can send cross-origin requests to /writeFile on localhost port 8089 to overwrite renderer scripts, executing JavaScript with Node.js access as the local user.

Event History

Nov 5, 2026

CVE Published

via MITRE·06:16 PM

Data Sourced

via MITRE·06:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users running the Electron desktop build of noname from v1.11.2 through v1.11.6.1 are exposed while its local file server is reachable on localhost port 8089. A malicious website can target the local server from the user's browser because the server permits wildcard cross-origin requests.

What does an attacker need to exploit it?

The attacker needs to induce a user to visit a malicious website. No authentication to the local file server is required, and the attacker can send cross-origin requests to the /writeFile endpoint on localhost port 8089.

What is the impact of successful exploitation?

An attacker can read, overwrite, or delete installation files. Overwriting renderer scripts can result in JavaScript execution with Node.js access as the local user.

CVE-2026-123208: noname v1.11.2 through v1.11.6.1 Missing Authentication in Electron Local File Server

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?