CVE-2026-123208

High

Description

noname Electron desktop build v1.11.2 through v1.11.6.1 contains an unauthenticated local file server with wildcard CORS that allows malicious websites to read, overwrite, or delete installation files. Attackers can send cross-origin requests to /writeFile on localhost port 8089 to overwrite renderer scripts, executing JavaScript with Node.js access as the local user.

SeverityHigh

CVSS8.8

Exploit probability—

ProductNoname

PublishedNov 5, 2026

First seenNov 5, 2026

Weakness typeCWE-306Missing authentication for critical function

How to fix

Patches

github.com/libnoname/noname/pull/4606
github.com/libnoname/noname/commit/b5793c5abdc957a3a2c0ad44abfc4849f3ac3219

Affected products

Product	Affected versions	Fixed in
libnoname noname	v1.11.2 ≤ v ≤ v1.11.6.1	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.