CVE-2026-123208— noname v1.11.2 through v1.11.6.1 Missing Authentication in Electron Local File Server

Quick assessment

Affected

libnoname noname

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

未命名的 Electron 桌面构建版本 v1.11.2 至 v1.11.6.1 包含一个未经身份验证的本地文件服务器，并启用了通配符跨域资源共享（CORS）策略，这使得恶意网站能够读取、覆盖或删除安装文件。攻击者可向 localhost 的 8089 端口发送针对端点的跨域请求，从而覆盖渲染器脚本，进而以本地用户身份执行具有 Node.js 访问权限的 JavaScript 代码。

CVSS 8.8 · High Updated Nov 06, 2026

Possible ATT&CK Techniques 2 AI

T1059.007 · JavaScript T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
libnoname	noname	`v1.11.2≤ v1.11.6.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

noname v1.11.2 through v1.11.6.1 Missing Authentication in Electron Local File Server

Source: CVE Program / CVE List V5

Vulnerability Description

noname Electron desktop build v1.11.2 through v1.11.6.1 contains an unauthenticated local file server with wildcard CORS that allows malicious websites to read, overwrite, or delete installation files. Attackers can send cross-origin requests to /writeFile on localhost port 8089 to overwrite renderer scripts, executing JavaScript with Node.js access as the local user.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

关键功能的认证机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
libnoname	noname	v1.11.2 ~ v1.11.6.1	-

II. Public POCs for CVE-2026-123208

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123208

请登录查看更多情报信息。

Other References for CVE-2026-123208 (6)

https://github.com/libnoname/noname/blob/0b7e4be4b6ef64ab8579b2ffc643a2a626e4fede/apps/electron/app/main.ts#L6-L13 technical-description
https://github.com/libnoname/noname/pull/4606 patch issue-tracking
https://github.com/libnoname/noname/issues/4524 issue-tracking
https://github.com/libnoname/noname/commit/b5793c5abdc957a3a2c0ad44abfc4849f3ac3219 patch
https://github.com/libnoname/noname/blob/0b7e4be4b6ef64ab8579b2ffc643a2a626e4fede/packages/fs/src/index.ts#L71-L74 technical-description
https://www.vulncheck.com/advisories/noname-1.11.2-through-1.11.6.1-missing-authentication-in-electron-local-file-server third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123208

IV. Related Vulnerabilities

Same weakness: CWE-306