CVE-2026-109558

Published: Oct 12, 2026Modified: Oct 16, 2026Deferred

8.5

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token to run script on preview and access the privileged window.edgeeverDesktop bridge.

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (7)

https://github.com/tianma-if/edgeever

Source: disclosure@vulncheck.com

https://github.com/tianma-if/edgeever/blob/f6ade70423ba366077653dbb8ac43a677933c776/apps/web/src/components/TemplatesPane.tsx#L150-L158

Source: disclosure@vulncheck.com

https://github.com/tianma-if/edgeever/commit/6b5027e8b4becbee0c0de7cd1a3d04af78ca87ca

Source: disclosure@vulncheck.com

https://github.com/tianma-if/edgeever/issues/533

Source: disclosure@vulncheck.com

https://github.com/tianma-if/edgeever/issues/546

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/edgeever-1.6.0-through-1.112.0-stored-xss-via-templatespane-template-preview

Source: disclosure@vulncheck.com

https://github.com/tianma-if/edgeever/issues/533

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.