Unauthenticated Local File Server Vulnerability in Noname Electron Desktop
CVE-2026-123208

7.7HIGH

Key Information:

Vendor

Libnoname

Status
Noname
Vendor
CVE Published:
5 November 2026

What is CVE-2026-123208?

The Noname Electron desktop builds from v1.11.2 to v1.11.6.1 are susceptible to a vulnerability that enables an unauthenticated local file server. This flaw allows malicious websites to make cross-origin requests, which could lead to reading, overwriting, or deleting installation files on users' systems. An attacker can exploit this vulnerability by targeting the /writeFile endpoint on localhost port 8089, thereby executing JavaScript with Node.js privileges as the local user. This poses significant risks to user data and system integrity.

Affected Version(s)

noname v1.11.2

References

https://github.com/libnoname/noname/issues/4524
issue-tracking
https://github.com/libnoname/noname/pull/4606
patchissue-tracking
https://github.com/libnoname/noname/commit/b5793c5abdc957...
patch

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
rintim
.