Description

noname Electron desktop build v1.11.2 through v1.11.6.1 contains an unauthenticated local file server with wildcard CORS that allows malicious websites to read, overwrite, or delete installation files. Attackers can send cross-origin requests to /writeFile on localhost port 8089 to overwrite renderer scripts, executing JavaScript with Node.js access as the local user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-11-05T19:17:20.380Z",
  "pubdate": "2026-11-05T19:17:20.380Z",
  "executiveSummary": "The noname Electron desktop application, versions 1.11.2 through 1.11.6.1, is susceptible to an arbitrary file read/write and deletion vulnerability stemming from an insecurely configured local file server.\nThe vulnerability arises from the implementation of a local web server binding to localhost port 8089, which utilizes a wildcard Cross-Origin Resource Sharing (CORS) policy. This configuration permits unauthorized cross-origin requests from malicious websites to interact with the application's internal functions.\nThe primary risk involves an unauthenticated attacker executing arbitrary code with the privileges of the local user by overwriting renderer scripts. By exploiting the /writeFile endpoint, an attacker can replace critical application components with malicious payloads, achieving full remote code execution (RCE) via Node.js context access.\nThis vulnerability is critical due to the ease of exploitation, as it requires no prior authentication and can be triggered via a simple web browser interaction, effectively bypassing traditional application security perimeters.",
  "technicalDetails": "The vulnerability resides within the local management server embedded in noname Electron builds v1.11.2 through v1.11.6.1, which exposes an administrative interface on port 8089. The core security failure is the combination of an unauthenticated state and an overly permissive CORS policy configured with a wildcard (*) origin.\nThe attack flow begins when a user visits a malicious website while the vulnerable desktop application is running. The attacker's script initiates a cross-origin HTTP request to http://localhost:8089/writeFile. Because the server does not enforce origin validation or authentication, it processes the incoming request as a legitimate command.\nThe /writeFile function allows for the modification of arbitrary files within the application's environment. An attacker can specifically target the application's renderer scripts or other executable assets stored in the installation directory. By overwriting these scripts with malicious JavaScript, the attacker can leverage the application's integrated Node.js environment.\nOnce the renderer script is overwritten, the next execution of the application—or a reload of the affected renderer process—will trigger the malicious payload. Because the renderer in this Electron context has access to Node.js APIs, the attacker gains the ability to execute arbitrary system commands, manipulate the file system, or exfiltrate sensitive data as the local user.\nIn addition to arbitrary file writing, the insecure implementation of the /writeFile and associated API endpoints facilitates arbitrary file reads and deletions. This allows for total compromise of the application's data integrity and confidentiality. The lack of an authentication mechanism on port 8089 means that any local process or remote origin (if the browser handles the CORS preflight) can interface with these privileged file system operations without restriction. The exploit chain is highly reliable, requiring only the victim to reach the attacker-controlled page, at which point the browser acts as a proxy for the malicious requests to the local server, effectively tunneling commands to the host operating system."
}