noname Electron: Unauthenticated Local File Access and RCE (CVE-2026-123208)

The noname Electron desktop application, versions 1.11.2 through 1.11.6.1, includes an insecure local file server listening on port 8089. The server implements wildcard Cross-Origin Resource Sharing (CORS) headers, which enables arbitrary websites to send cross-origin requests to the application. An attacker can exploit this to interact with the /writeFile endpoint to read, overwrite, or delete local files. Successful exploitation allows for the overwriting of renderer scripts, leading to remote code execution in the context of the user running the application with Node.js privileges.

Impact

Successful exploitation allows for unauthorized arbitrary file operations, including overwriting application scripts to execute code with the permissions of the local system user.

Recommendation

• Inventory all systems running noname Electron desktop build versions 1.11.2 through 1.11.6.1.
• Monitor for local network connections to port 8089 originating from browser processes (e.g., chrome.exe, firefox.exe, edge.exe).
• If the application cannot be updated, restrict access to port 8089 on the host loopback interface to prevent unauthorized cross-origin requests.