CVE-2026-109558

Received Received - Intake

Stored XSS in EdgeEver Desktop via Template Content

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token to run script on preview and access the privileged window.edgeeverDesktop bridge.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109558

Affected Vendors & Products

Vendor	Product	Version / Range
tianma-if	EdgeEver	1.6.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

EdgeEver versions 1.6.0 through 1.112.0 have a stored cross-site scripting (XSS) vulnerability in the TemplatesPane.tsx file. The issue occurs because template content marked as markdown is rendered using raw HTML via dangerouslySetInnerHTML without proper sanitization. Attackers can exploit this by injecting HTML event handlers through an API or MCP token, which then executes malicious scripts during preview and potentially accesses privileged interfaces like the window.edgeeverDesktop bridge.

Detection Guidance

This vulnerability involves stored XSS in EdgeEver due to unsanitized HTML rendering. To detect it, inspect EdgeEver templates for HTML event handlers like onerror, onload, or onclick in template content. Check API responses or MCP token payloads for raw HTML tags. No specific commands are provided, but manual review of template files and API logs is recommended.

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript code in the context of the affected application. This could lead to theft of sensitive data, session hijacking, or unauthorized actions performed on behalf of the user. If the application handles privileged data or interfaces, attackers might gain elevated access through the bridge interface.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using this software may face compliance violations, legal penalties, and reputational damage due to potential data breaches resulting from the XSS flaw.

Mitigation Strategies

Update EdgeEver to the latest version beyond 1.112.0 where the vulnerability is patched. If immediate update is not possible, disable the use of raw HTML in templates or restrict template creation to trusted users only.

Hi! I’m here to help you understand CVE-2026-109558. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70