Read the docs
TI-2026-85587 Aliases CVE-2026-123208GHSA-q48j-7m3q-9pj6

Missing authentication in noname Electron file server

Priority LOW 34CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

The noname Electron desktop build from v1.11.2 through v1.11.6.1 runs a local file server without authentication (CWE-306) and sends wildcard CORS headers. A malicious website can send cross-origin requests to /writeFile on localhost port 8089 to read, overwrite or delete installation files. Overwriting renderer scripts lets the attacker run JavaScript with Node.js access as the local user.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

noname Electron desktop build v1.11.2 through v1.11.6.1 contains an unauthenticated local file server with wildcard CORS that allows malicious websites to read, overwrite, or delete installation files. Attackers can send cross-origin requests to /writeFile on localhost port 8089 to overwrite renderer scripts, executing JavaScript with Node.js access as the local user.

Why it matters now

EPSS 0.00376 31st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
libnonamenonamev1.11.2 – v1.11.6.1—No fix listedCNA
  • noname Vendorlibnoname Affected v1.11.2 – v1.11.6.1 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for noname.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-123208
  2. 2026-11-05 Alias added: GHSA-q48j-7m3q-9pj6
  3. 2026-11-06 Affected versions changed · Red Hat
  4. 2026-11-06 CVSS score added · Red Hat
  5. 2026-11-07 Priority changed: MEDIUM → LOW

References

Patch 2

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences