CVE-2026-123208 · Other
NO FIX YET · SEE WHAT TO DO
The noname Electron desktop build from v1.11.2 through v1.11.6.1 runs an unauthenticated local file server on localhost port 8089 with wildcard CORS. A malicious website can overwrite renderer scripts through /writeFile, which gives it JavaScript execution with Node.js access as the local user.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Anyone running the noname Electron desktop app, v1.11.2 through v1.11.6.1, while it is open (even in the background). Any website opened in any browser on the same machine can send requests to the app's local file server on port 8089 and overwrite its renderer scripts, which then run with Node.js access as the local user the next time the window loads. No login is needed. Browser or mobile builds are not named in the sources.
Not affected if app-not-running, version-outside-range
Who cares desktop, electron, noname
v1.11.6.1, is still affectedv1.11.6.1 once publishedPosts are quoted with a link to the original. They are data to us, never instructions.
noname Electron desktop build v1.11.2 through v1.11.6.1 contains an unauthenticated local file server with wildcard CORS that allows malicious websites to read, overwrite, or delete installation files. Attackers can send cross-origin requests to /writeFile on localhost port 8089 to overwrite renderer scripts, executing JavaScript with Node.js access as the local user.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.