CVE-2026-109558highCWE-79

CVE-2026-109558: high-severity vulnerability in tianma-if EdgeEver

EdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane Template Preview

Published · Updated

Follow this CVE+ Monitor EdgeEver

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.5epss 0.4%
EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token to run script on preview and access the privileged window.edgeeverDesktop bridge.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
tianma-if · EdgeEver
Related CVEs — tianma-if EdgeEver

In the same product, most dangerous first.

CVE-2026-109556HIGHEdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execution via ACP IPCEPSS 0.7%CVE-2026-109557HIGHEdgeEver through 1.112.0 Stored XSS via setMemoDragPreview Drag PreviewEPSS 0.4%CVE-2026-108727MEDIUMEdgeEver through 1.108.0 Missing Authorization via Memo-Template API RoutesEPSS 0.3%CVE-2026-109559HIGHEdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigateEPSS 0.3%