Threats tagged 'ghsa-q48j-7m3q-9pj6'

Versions 1.11.2 through 1.11.6.1 of the noname Electron desktop build contain an unauthenticated local file server with a wildcard CORS policy. This vulnerability allows malicious websites to send cross-origin requests to the local server on port 8089, enabling them to read, overwrite, or delete installation files. Specifically, attackers can overwrite renderer scripts, resulting in execution of arbitrary JavaScript with Node.js privileges as the local user.