CVE-2026-123208
Received Received - Intake

Unauthenticated Local File Server in noname Electron Desktop

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: VulnCheck

Description
noname Electron desktop build v1.11.2 through v1.11.6.1 contains an unauthenticated local file server with wildcard CORS that allows malicious websites to read, overwrite, or delete installation files. Attackers can send cross-origin requests to /writeFile on localhost port 8089 to overwrite renderer scripts, executing JavaScript with Node.js access as the local user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-06
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-123208
EUVD
EUVD-2026-117653

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
libnoname noname v1.11.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Electron desktop build of the Noname application versions 1.11.2 through 1.11.6.1. It involves an unauthenticated local file server running on port 8089 with wildcard CORS configuration. This setup allows any malicious website open in a browser on the same machine to send cross-origin requests to endpoints like /writeFile, enabling attackers to read, overwrite, or delete installation files without authentication.

Detection Guidance

Check if the noname application is running a local server on port 8089 by using commands like 'netstat -ano | findstr 8089' on Windows or 'lsof -i :8089' on Linux/macOS. If the server is active, verify if it responds to cross-origin requests by testing endpoints like http://localhost:8089/writeFile with a browser or curl.

Impact Analysis

An attacker can exploit this to overwrite renderer scripts in the Noname app, executing JavaScript with Node.js access under your local user privileges. This could lead to arbitrary file manipulation, potential system compromise upon app restart, or full control over your system if the app runs with elevated permissions.

Mitigation Strategies

Update the noname application to the latest version where the vulnerability is patched. If updating is not possible, disable the local file server by removing the @noname/fs package or blocking port 8089 in your firewall. Avoid running the application with nodeIntegration or contextIsolation disabled.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123208. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...