CVE-2026-123208
Description
A flaw was found in noname. The Electron desktop application runs an unauthenticated local file server configured with overly permissive Cross-Origin Resource Sharing (CORS) settings. A remote attacker can exploit this flaw by tricking a user into visiting a malicious website that sends cross-origin requests to overwrite application files. Successful exploitation allows the attacker to achieve arbitrary code execution with the privileges of the local user.
Statement
This vulnerability is rated as Important severity rather than Critical because successful exploitation requires user interaction to browse an untrusted website, despite allowing arbitrary code execution with the privileges of the logged-in user. Red Hat products do not distribute or support this standalone desktop application, leaving default enterprise environments unaffected. In scenarios where this software is independently deployed, exposure is restricted to active desktop sessions running both the application and a web browser.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to eliminate the unauthenticated local HTTP file server on localhost port 8089 and restrict application file access to an internal custom protocol handler: upgrade to the fixed release, which remove the listening HTTP server dependency and replace it with an Electron custom protocol handler that permits only GET and HEAD requests within the application directory, closing all 2 injection vectors (cross-origin HTTP POST requests to localhost file server, overwriting application renderer scripts via /writeFile). Until patched, this is a concern on desktop hosts running the vulnerable noname Electron desktop application during active browser sessions, so avoid visiting untrusted websites while the noname Electron desktop application is actively running in the user session. As a compensating measure, enforce access control on the sensitive /writeFile URL path to impede unauthenticated manipulation of renderer scripts, deploy EDR agents to detect anomalous child process execution and script modifications when overwritten renderer scripts execute Node.js commands, and use AIDE or file integrity monitoring to detect unauthorized modifications when application files are overwritten in the local filesystem. These controls limit blast radius and contain exploitation, but they do not fix the underlying unauthenticated local file server defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-909 Default-Deny API Authorization Policy (high)
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
Exposing critical functionality essentially provides an attacker with the privilege level of that functionality. The consequences will depend on the associated functionality, but they can range from reading or modifying sensitive data, accessing administrative or other privileged functionality, or possibly even executing arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
