CVE-2026-109558highCWE-79

CVE-2026-109558: fallo de gravedad alta en tianma-if EdgeEver

EdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane Template Preview

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear EdgeEver

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.5epss 0.4%
EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token to run script on preview and access the privileged window.edgeeverDesktop bridge.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
tianma-if · EdgeEver
CVEs relacionadas — tianma-if EdgeEver

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-109556HIGHEdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execution via ACP IPCEPSS 0.7%CVE-2026-109557HIGHEdgeEver through 1.112.0 Stored XSS via setMemoDragPreview Drag PreviewEPSS 0.4%CVE-2026-108727MEDIUMEdgeEver through 1.108.0 Missing Authorization via Memo-Template API RoutesEPSS 0.3%CVE-2026-109559HIGHEdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigateEPSS 0.3%