CVE-2026-109557

Received Received - Intake

Stored XSS in EdgeEver Notebook via Malicious Memo Titles

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP create_notebook, rename_notebook or create_memo tools, running script on drag with access to the desktop bridge's session token.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109557

Affected Vendors & Products

Vendor	Product	Version / Range
tianma-if	EdgeEver	0.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

EdgeEver through version 1.112.0 has a stored cross-site scripting (XSS) vulnerability in the setMemoDragPreview function. Attackers can inject malicious scripts through notebook names or memo titles by using tools like MCP create_notebook, rename_notebook, or create_memo. The script executes when a user drags an item, potentially accessing the desktop bridge's session token.

Detection Guidance

This vulnerability involves stored XSS in EdgeEver through notebook names or memo titles. To detect it, inspect user-generated content in notebook names or memo titles for suspicious scripts or unexpected characters. Check application logs for MCP tool usage like create_notebook, rename_notebook, or create_memo with unusual inputs.

Impact Analysis

This vulnerability allows attackers to run malicious scripts in your browser when you interact with affected notebooks or memos. They could steal session tokens, perform actions on your behalf, or access sensitive data. The impact depends on your permissions and the data you handle in EdgeEver.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using EdgeEver may face compliance risks if user data is compromised through this XSS flaw.

Mitigation Strategies

Immediately update EdgeEver to the latest version beyond 1.112.0. Implement input validation and sanitization for notebook names and memo titles to block script injection. Restrict MCP tool access to trusted users only and monitor for unauthorized changes to notebooks or memos.

Hi! I’m here to help you understand CVE-2026-109557. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70