This vulnerability consists of an unauthenticated local file server that runs on Electron desktop builds of noname. The server exposes a wildcard CORS policy, which allows any web page to send cross‑origin requests to the local host on port 8089. Attackers can read, overwrite, or delete files in the installation directory by calling endpoints such as /writeFile, and can execute arbitrary JavaScript with Node.js privileges under the local user context.

The affected product is libnoname's noname application, versions 1.11.2 through 1.11.6.1. These releases bundle the vulnerable local file server that is not protected by authentication.

The vulnerability carries a CVSS score of 7.7, indicating high severity. The EPSS score is not available, so the exact likelihood of exploitation in the wild remains unknown, and the vulnerability has not been listed in the CISA KEV catalog. However, the absence of authentication and the permissive CORS policy mean that any malicious web page loaded on the affected machine can exploit the file server, potentially leading to code execution as the local user. The attack vector is local, but a web attacker could leverage the user's browser to perform the attack if the user visits a malicious site.