Cpe:2.3:a:noname:electron_desktop:1.11.6.1:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3anonameelectron_desktop1.11.6.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 22:33:45 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgnoname Electron: Unauthenticated Local File Access and RCE (CVE-2026-123208)https://feed.craftedsignal.io/briefs/2026-11-cve-2026-123208/Thu, 05 Nov 2026 22:33:45 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-123208/The noname Electron desktop application (versions 1.11.2 to 1.11.6.1) contains an unauthenticated local file server on port 8089 with wildcard CORS, allowing remote attackers to achieve code execution via malicious cross-origin requests.The noname Electron desktop application, versions 1.11.2 through 1.11.6.1, includes an insecure local file server listening on port 8089. The server implements wildcard Cross-Origin Resource Sharing (CORS) headers, which enables arbitrary websites to send cross-origin requests to the application. An attacker can exploit this to interact with the /writeFile endpoint to read, overwrite, or delete local files. Successful exploitation allows for the overwriting of renderer scripts, leading to remote code execution in the context of the user running the application with Node.js privileges.

Impact

Successful exploitation allows for unauthorized arbitrary file operations, including overwriting application scripts to execute code with the permissions of the local system user.

Recommendation

  • Inventory all systems running noname Electron desktop build versions 1.11.2 through 1.11.6.1.
  • Monitor for local network connections to port 8089 originating from browser processes (e.g., chrome.exe, firefox.exe, edge.exe).
  • If the application cannot be updated, restrict access to port 8089 on the host loopback interface to prevent unauthorized cross-origin requests.
]]>highadvisory