CVE-2026-123208

    Dashboard / Vulnerabilities / CVE-2026-123208

    CVE-2026-123208

    Published: 5 Nov 2026Last Modified: 7 Nov 2026

    Summary: noname v1.11.2 through v1.11.6.1 Missing Authentication in Electron Local File Server

    Details: noname Electron desktop build v1.11.2 through v1.11.6.1 contains an unauthenticated local file server with wildcard CORS that allows malicious websites to read, overwrite, or delete installation files. Attackers can send cross-origin requests to /writeFile on localhost port 8089 to overwrite renderer scripts, executing JavaScript with Node.js access as the local user.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123208.json, https://nvd.nist.gov/vuln/detail/CVE-2026-123208, https://www.vulncheck.com/advisories/noname-1.11.2-through-1.11.6.1-missing-authentication-in-electron-local-file-server, https://github.com/libnoname/noname/issues/4524, https://github.com/libnoname/noname/commit/b5793c5abdc957a3a2c0ad44abfc4849f3ac3219, https://github.com/libnoname/noname/pull/4606, https://github.com/libnoname/noname, https://github.com/libnoname/noname/blob/0b7e4be4b6ef64ab8579b2ffc643a2a626e4fede/apps/electron/app/main.ts#L6-L13, https://github.com/libnoname/noname/blob/0b7e4be4b6ef64ab8579b2ffc643a2a626e4fede/packages/fs/src/index.ts#L71-L74

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 68c858157930c19b82bdf088bb23d0151880819d
    Fixed -b5793c5abdc957a3a2c0ad44abfc4849f3ac3219

    Affected versions

    v1.11.6
    v1.11.5
    v1.11.4.1
    v1.11.4
    v1.11.3
    v1.11.2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-123208 | CVE-DB