CVE-2026-123208

Summary

The Electron desktop build v1.11.2–v1.11.6.1 exposes an unauthenticated local HTTP server on port 8089 with wildcard CORS, allowing any malicious website visited by the user to send cross-origin requests to /writeFile and overwrite renderer scripts, leading to arbitrary code execution with Node.js privileges as the local user.

Exploitability

Exploitation requires the victim to visit a malicious website while the vulnerable Electron app is running; no authentication or special privileges are needed beyond standard web browsing.

Blast radius

Successful exploitation allows full compromise of the local user account, including reading, modifying, or deleting application and system files, and executing arbitrary code with elevated Node.js permissions.

Detection

Defenders may observe unexpected outbound HTTP requests from the Electron process to localhost:8089 (especially POST to /writeFile) in network logs, or monitor for unexpected modification of renderer script files (e.g., dist/main.js, resources/app.asar) by non-updater processes. If such logging is not enabled, no reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Electron v1.11.7 or later, which patches the vulnerable local file server endpoint.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.