CVE-2026-123208 | BDVDB-2026-400883 Detail
libnonamenoname
Description#
noname Electron desktop build v1.11.2 through v1.11.6.1 contains an unauthenticated local file server with wildcard CORS that allows malicious websites to read, overwrite, or delete installation files. Attackers can send cross-origin requests to /writeFile on localhost port 8089 to overwrite renderer scripts, executing JavaScript with Node.js access as the local user.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-306 Missing Authentication for Critical Function
References#
- https://github.com/libnoname/noname/issues/4524
- https://github.com/libnoname/noname/pull/4606
- https://github.com/libnoname/noname/commit/b5793c5abdc957a3a2c0ad44abfc4849f3ac3219
- https://github.com/libnoname/noname/blob/0b7e4be4b6ef64ab8579b2ffc643a2a626e4fede/packages/fs/src/index.ts#L71-L74
- https://github.com/libnoname/noname/blob/0b7e4be4b6ef64ab8579b2ffc643a2a626e4fede/apps/electron/app/main.ts#L6-L13
- https://www.vulncheck.com/advisories/noname-1.11.2-through-1.11.6.1-missing-authentication-in-electron-local-file-server
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.