{"id":"CVE-2026-123208","kind":"vulnerability","aliases":["CVE-2026-123208"],"related":[],"title":"noname Electron desktop app: local file server lets websites run code","description":"noname Electron desktop build v1.11.2 through v1.11.6.1 contains an unauthenticated local file server with wildcard CORS that allows malicious websites to read, overwrite, or delete installation files. Attackers can send cross-origin requests to /writeFile on localhost port 8089 to overwrite renderer scripts, executing JavaScript with Node.js access as the local user.","summary":"The noname Electron desktop build from v1.11.2 through v1.11.6.1 runs an unauthenticated local file server on localhost port 8089 with wildcard CORS. A malicious website can overwrite renderer scripts through /writeFile, which gives it JavaScript execution with Node.js access as the local user.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","electron","noname","other"],"not_affected_if":["app-not-running","version-outside-range"],"how_to_check":"- Check the noname desktop app version: v1.11.2 through v1.11.6.1 is affected per VulnCheck.\n- While the app runs, check whether something listens on localhost port 8089 (e.g. 'ss -ltn | grep 8089' on Linux, 'netstat -ano | findstr 8089' on Windows). Open means the file server is up.\n- Also check any other noname build you run that bundles @noname/fs; the sources only confirm the Electron desktop build.","fix":"Fixed in source by commit b5793c5 (PR #4606, merged 2026-11-05), which removes the local HTTP server. No released version containing it found; the latest release, v1.11.6.1, is still affected. Move to the first release after v1.11.6.1 once published. Until then, close the desktop app before browsing other sites.","status":"open","published_at":"2026-11-05T19:17:20+00:00","first_seen_at":"2026-11-05T19:40:36+00:00","triaged_at":"2026-11-05T19:42:38+00:00","updated_at":"2026-11-05T19:44:03+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-05T19:42:38Z","model":"claude-haiku-5-5","output":{"fix":"- unknown; the sources point to a patch on GitHub but do not state the fixed version","reach":"local","title":"noname Electron desktop app: local file server lets websites run code","impact":"high","summary":"The noname Electron desktop build from v1.11.2 through v1.11.6.1 runs an unauthenticated local file server on localhost port 8089 with wildcard CORS. A malicious website can overwrite renderer scripts through /writeFile, which gives it JavaScript execution with Node.js access as the local user.","audience":"everyone","category":"other","nicknames":[],"who_cares":["noname","electron","desktop"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs JavaScript with Node.js access as the local user","analyst_note":"Confirm the fixed version and the patch details at the GitHub fix link and the VulnCheck advisory; the NVD entry gives no fixed version.","how_to_check":"- Check the installed noname desktop app version against the affected range `v1.11.2` through `v1.11.6.1`\n- Check whether anything listens on localhost port `8089` while the app runs\n- unknown for other settings","plain_action":"If you use the noname desktop app, check its version and wait for the developer's update before opening it on untrusted sites.","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Anyone running the affected noname Electron desktop build on a machine where a browser is also used. A malicious page visited in a browser can reach the local file server because of wildcard CORS, so the risk does not need the user to log in to noname. Installs outside the listed version range are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000735,"input_tokens":4292,"output_tokens":612,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the patch details at the GitHub fix link and the VulnCheck advisory; the NVD entry gives no fixed version.","search":"'-123208':14A,17A '-2026':13A,16A '/writefile':51B,99C '8089':39B,103C 'access':59B,112C 'allow':81C 'app':4A 'attack':91C 'build':25B,67C 'code':11A 'contain':71C 'cor':42B,79C 'cross':95C 'cross-origin':94C 'cve':12A,15A 'delet':88C 'desktop':3A,18B,24B,66C 'electron':2A,19B,23B,65C 'execut':56B,108C 'file':6A,34B,75C,90C 'give':53B 'instal':89C 'javascript':55B,109C 'let':8A 'local':5A,33B,62B,74C,115C 'localhost':37B,101C 'malici':44B,82C 'node.js':58B,111C 'nonam':1A,20B,22B,64C 'origin':96C 'overwrit':47B,86C,105C 'port':38B,102C 'read':85C 'render':48B,106C 'request':97C 'run':10A,30B 'script':49B,107C 'send':93C 'server':7A,35B,76C 'unauthent':32B,73C 'user':63B,116C 'v1.11.2':27B,68C 'v1.11.6.1':29B,70C 'websit':9A,45B,83C 'wildcard':41B,78C","nicknames":[],"mitigations":[],"who_affected":"Anyone running the noname Electron desktop app, v1.11.2 through v1.11.6.1, while it is open (even in the background). Any website opened in any browser on the same machine can send requests to the app's local file server on port 8089 and overwrite its renderer scripts, which then run with Node.js access as the local user the next time the window loads. No login is needed. Browser or mobile builds are not named in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you use the noname desktop app, check its version and wait for the developer's update before opening it on untrusted sites.","pkeys":[],"ptokens":[],"labels":["desktop","electron","high","noname","other"],"campaign_type":null,"first_public_at":"2026-11-05T19:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123208","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123208","severity":null,"published_at":"2026-11-05T19:17:20+00:00","modified_at":"2026-11-05T19:17:20+00:00","first_seen_at":"2026-11-05T19:40:36+00:00","fetched_at":"2026-11-05T19:40:36+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123208:1823","url":"https://github.com/libnoname/noname/pull/4606","severity":null,"published_at":"2026-11-05T19:44:03+00:00","modified_at":"2026-11-05T19:44:03+00:00","first_seen_at":"2026-11-05T19:44:03+00:00","fetched_at":"2026-11-05T19:44:03+00:00","note":"Maintainer fix merged to main 2026-11-05 (PR #4606, commit b5793c5): removes the @noname/fs dependency and the HTTP server; desktop app intercepts http://localhost:8089 and reads local files instead. Latest release found is v1.11.6.1 (Oct 26), which is affected; no release containing the fix seen, so no fixed version. Range v1.11.2-v1.11.6.1 is from VulnCheck only; the issue confirms a commit, not the range. Nothing marked verified. Not exploited, no PoC (issue says steps on request). Triage fix_status 'none' is left as is; patch exists but unreleased.","cites":["https://github.com/libnoname/noname/pull/4606","https://github.com/libnoname/noname/issues/4524"]}],"documents":[{"id":79213,"url":"https://github.com/libnoname/noname/commit/b5793c5abdc957a3a2c0ad44abfc4849f3ac3219","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79214,"url":"https://www.vulncheck.com/advisories/noname-1.11.2-through-1.11.6.1-missing-authentication-in-electron-local-file-server","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":79512,"url":"https://github.com/libnoname/noname/pull/4606","title":"noname PR #4606: replace local HTTP server with protocol interception (merged 2026-11-05)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":79514,"url":"https://github.com/libnoname/noname/issues/4524","title":"noname issue #4524: Unauthenticated CORS-wildcard local file server in Electron build","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}