{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123208", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-05T17:58:52.574Z", "datePublished": "2026-11-05T18:16:42.581Z", "dateUpdated": "2026-11-05T18:16:42.581Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T18:16:42.581Z"}, "datePublic": "2026-10-16T00:00:00.000Z", "title": "noname v1.11.2 through v1.11.6.1 Missing Authentication in Electron Local File Server", "descriptions": [{"lang": "en", "value": "noname Electron desktop build v1.11.2 through v1.11.6.1 contains an unauthenticated local file server with wildcard CORS that allows malicious websites to read, overwrite, or delete installation files. Attackers can send cross-origin requests to /writeFile on localhost port 8089 to overwrite renderer scripts, executing JavaScript with Node.js access as the local user."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Missing Authentication for Critical Function", "cweId": "CWE-306", "type": "CWE"}]}], "affected": [{"vendor": "libnoname", "product": "noname", "defaultStatus": "unaffected", "versions": [{"version": "v1.11.2", "lessThanOrEqual": "v1.11.6.1", "status": "affected", "versionType": "custom"}], "packageURL": "pkg:github/libnoname/noname", "repo": "https://github.com/libnoname/noname"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/libnoname/noname/issues/4524", "tags": ["issue-tracking"]}, {"url": "https://github.com/libnoname/noname/pull/4606", "tags": ["patch", "issue-tracking"]}, {"url": "https://github.com/libnoname/noname/commit/b5793c5abdc957a3a2c0ad44abfc4849f3ac3219", "tags": ["patch"]}, {"url": "https://github.com/libnoname/noname/blob/0b7e4be4b6ef64ab8579b2ffc643a2a626e4fede/packages/fs/src/index.ts#L71-L74", "tags": ["technical-description"]}, {"url": "https://github.com/libnoname/noname/blob/0b7e4be4b6ef64ab8579b2ffc643a2a626e4fede/apps/electron/app/main.ts#L6-L13", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: noname v1.11.2 through v1.11.6.1 Missing Authentication in Electron Local File Server", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/noname-1.11.2-through-1.11.6.1-missing-authentication-in-electron-local-file-server"}], "credits": [{"lang": "en", "value": "George Chen", "type": "finder"}, {"lang": "en", "value": "rintim", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/libnoname/noname", "product": "noname", "repo": "https://github.com/libnoname/noname", "vendor": "libnoname", "versions": [{"lessThanOrEqual": "v1.11.6.1", "status": "affected", "version": "v1.11.2", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "noname Electron desktop build v1.11.2 through v1.11.6.1 contains an unauthenticated local file server with wildcard CORS that allows malicious websites to read, overwrite, or delete installation files. Attackers can send cross-origin requests to /writeFile on localhost port 8089 to overwrite renderer scripts, executing JavaScript with Node.js access as the local user."}], "id": "CVE-2026-123208", "lastModified": "2026-11-05T19:17:20.380", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-11-05T19:17:20.380", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/libnoname/noname/blob/0b7e4be4b6ef64ab8579b2ffc643a2a626e4fede/apps/electron/app/main.ts#L6-L13"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/libnoname/noname/blob/0b7e4be4b6ef64ab8579b2ffc643a2a626e4fede/packages/fs/src/index.ts#L71-L74"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/libnoname/noname/commit/b5793c5abdc957a3a2c0ad44abfc4849f3ac3219"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/libnoname/noname/issues/4524"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/libnoname/noname/pull/4606"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/noname-1.11.2-through-1.11.6.1-missing-authentication-in-electron-local-file-server"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "noname: noname: Arbitrary code execution via unauthenticated local file server", "id": "2567485", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567485"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-306", "details": ["A flaw was found in noname. The Electron desktop application runs an unauthenticated local file server configured with overly permissive Cross-Origin Resource Sharing (CORS) settings. A remote attacker can exploit this flaw by tricking a user into visiting a malicious website that sends cross-origin requests to overwrite application files. Successful exploitation allows the attacker to achieve arbitrary code execution with the privileges of the local user."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-123208", "public_date": "2026-11-05T18:16:42Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123208\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123208\nhttps://github.com/libnoname/noname/blob/0b7e4be4b6ef64ab8579b2ffc643a2a626e4fede/apps/electron/app/main.ts#L6-L13\nhttps://github.com/libnoname/noname/blob/0b7e4be4b6ef64ab8579b2ffc643a2a626e4fede/packages/fs/src/index.ts#L71-L74\nhttps://github.com/libnoname/noname/commit/b5793c5abdc957a3a2c0ad44abfc4849f3ac3219\nhttps://github.com/libnoname/noname/issues/4524\nhttps://github.com/libnoname/noname/pull/4606\nhttps://www.vulncheck.com/advisories/noname-1.11.2-through-1.11.6.1-missing-authentication-in-electron-local-file-server"], "statement": "This vulnerability is rated as Important severity rather than Critical because successful exploitation requires user interaction to browse an untrusted website, despite allowing arbitrary code execution with the privileges of the logged-in user. Red Hat products do not distribute or support this standalone desktop application, leaving default enterprise environments unaffected. In scenarios where this software is independently deployed, exposure is restricted to active desktop sessions running both the application and a web browser.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[v1.11.2,v1.11.6.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "noname", "source": "cna", "vendor": "libnoname"}, "product": "noname", "vendor": "libnoname"}], "created": "2026-11-05T20:15:12.889698+00:00", "updated": "2026-11-06T16:35:22.900089+00:00", "vendors": ["libnoname", "libnoname$PRODUCT$noname"]}