{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/noname/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:noname:electron_desktop:1.11.2:*:*:*:*:*:*:*","cpe:2.3:a:noname:electron_desktop:1.11.6.1:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-123208"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Electron desktop build (v1.11.2 through v1.11.6.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["noname"],"content_html":"\u003cp\u003eThe noname Electron desktop application, versions 1.11.2 through 1.11.6.1, includes an insecure local file server listening on port 8089. The server implements wildcard Cross-Origin Resource Sharing (CORS) headers, which enables arbitrary websites to send cross-origin requests to the application. An attacker can exploit this to interact with the /writeFile endpoint to read, overwrite, or delete local files. Successful exploitation allows for the overwriting of renderer scripts, leading to remote code execution in the context of the user running the application with Node.js privileges.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized arbitrary file operations, including overwriting application scripts to execute code with the permissions of the local system user.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all systems running noname Electron desktop build versions 1.11.2 through 1.11.6.1.\u003c/li\u003e\n\u003cli\u003eMonitor for local network connections to port 8089 originating from browser processes (e.g., chrome.exe, firefox.exe, edge.exe).\u003c/li\u003e\n\u003cli\u003eIf the application cannot be updated, restrict access to port 8089 on the host loopback interface to prevent unauthorized cross-origin requests.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T22:33:45Z","date_published":"2026-11-05T22:33:45Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-123208/","summary":"The noname Electron desktop application (versions 1.11.2 to 1.11.6.1) contains an unauthenticated local file server on port 8089 with wildcard CORS, allowing remote attackers to achieve code execution via malicious cross-origin requests.","title":"noname Electron: Unauthenticated Local File Access and RCE (CVE-2026-123208)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-123208/"}],"language":"en","title":"CraftedSignal Threat Feed - Noname","version":"https://jsonfeed.org/version/1.1"}