Threats affecting pkg:github/noname

noname Electron desktop builds from version 1.11.2 through 1.11.6.1 include an unauthenticated local file server with wildcard CORS on localhost port 8089. This flaw allows malicious websites to send cross-origin requests to the /writeFile endpoint, enabling them to read, overwrite, or delete installation files. Exploitation can lead to execution of arbitrary JavaScript with Node.js privileges as the local user.