---
id: "CVE-2026-123208"
kind: "vulnerability"
aliases: ["CVE-2026-123208"]
title: "noname Electron desktop app: local file server lets websites run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["desktop", "electron", "noname", "other"]
not_affected_if: ["app-not-running", "version-outside-range"]
published_at: "2026-11-05T19:17:20+00:00"
first_seen_at: "2026-11-05T19:40:36+00:00"
updated_at: "2026-11-05T19:44:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123208", "first_seen_at": "2026-11-05T19:40:36+00:00"}, {"source": "analyst", "url": "https://github.com/libnoname/noname/issues/4524", "first_seen_at": "2026-11-05T19:44:03+00:00", "cites": ["https://github.com/libnoname/noname/issues/4524", "https://github.com/libnoname/noname/pull/4606"]}]
exploit_sources: []
---

# noname Electron desktop app: local file server lets websites run code

The noname Electron desktop build from v1.11.2 through v1.11.6.1 runs an unauthenticated local file server on localhost port 8089 with wildcard CORS. A malicious website can overwrite renderer scripts through /writeFile, which gives it JavaScript execution with Node.js access as the local user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the noname desktop app version: v1.11.2 through v1.11.6.1 is affected per VulnCheck.
- While the app runs, check whether something listens on localhost port 8089 (e.g. 'ss -ltn | grep 8089' on Linux, 'netstat -ano | findstr 8089' on Windows). Open means the file server is up.
- Also check any other noname build you run that bundles @noname/fs; the sources only confirm the Electron desktop build.

## Fix

Fixed in source by commit b5793c5 (PR #4606, merged 2026-11-05), which removes the local HTTP server. No released version containing it found; the latest release, v1.11.6.1, is still affected. Move to the first release after v1.11.6.1 once published. Until then, close the desktop app before browsing other sites.

## Timeline

- 2026-11-05T19:40:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123208
- 2026-11-05T19:44:03+00:00 analyst https://github.com/libnoname/noname/issues/4524 — Maintainer fix merged to main 2026-11-05 (PR #4606, commit b5793c5): removes the @noname/fs dependency and the HTTP server; desktop app intercepts http://localhost:8089 and reads local files instead. Latest release found is v1.11.6.1 (Oct 26), which is affected; no release containing the fix seen, so no fixed version. Range v1.11.2-v1.11.6.1 is from VulnCheck only; the issue confirms a commit, not the range. Nothing marked verified. Not exploited, no PoC (issue says steps on request). Triage fix_status 'none' is left as is; patch exists but unreleased.

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/noname-1.11.2-through-1.11.6.1-missing-authentication-in-electron-local-file-server
- [describes] noname issue #4524: Unauthenticated CORS-wildcard local file server in Electron build https://github.com/libnoname/noname/issues/4524
- [fix] Patch: github.com https://github.com/libnoname/noname/commit/b5793c5abdc957a3a2c0ad44abfc4849f3ac3219
- [fix] noname PR #4606: replace local HTTP server with protocol interception (merged 2026-11-05) https://github.com/libnoname/noname/pull/4606

## From the sources

noname Electron desktop build v1.11.2 through v1.11.6.1 contains an unauthenticated local file server with wildcard CORS that allows malicious websites to read, overwrite, or delete installation files. Attackers can send cross-origin requests to /writeFile on localhost port 8089 to overwrite renderer scripts, executing JavaScript with Node.js access as the local user.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_