CVE-2026-109558 Details
Description
EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token to run script on preview and access the privileged window.edgeeverDesktop bridge.
A stored cross-site scripting vulnerability has been identified in EdgeEver versions 1.6.0 through 1.112.0. The issue resides in the TemplatesPane component, where template content is rendered as raw HTML using the marked parser, without any sanitization. This flaw allows attackers to inject HTML event handlers into templates, which can then execute scripts when the template is previewed. The injected script can access the privileged window.edgeeverDesktop bridge, potentially leading to unauthorized actions within the application.
The vulnerability has been addressed in EdgeEver version 1.113.0, where the HTML produced by Markdown parsing is sanitized before rendering. Users should update to this version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tianma-if/edgeever/issues/533 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/tianma-if/edgeever | [email protected] | Vendor |
| https://github.com/tianma-if/edgeever/blob/f6ade70423ba366077653dbb8ac43a677933c776/apps/web/src/components/TemplatesPane.tsx#L150-L158 | [email protected] | Source CodeVendor |
| https://github.com/tianma-if/edgeever/commit/6b5027e8b4becbee0c0de7cd1a3d04af78ca87ca | [email protected] | Source CodeVendor |
| https://github.com/tianma-if/edgeever/issues/533 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/tianma-if/edgeever/issues/546 | [email protected] | Issue TrackingVendor |
| https://www.vulncheck.com/advisories/edgeever-1.6.0-through-1.112.0-stored-xss-via-templatespane-template-preview | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| EdgeEver | >= 1.6.0, <= 1.112.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |