MajorCritical vulnerability

CVE-2026-109558 (CVSS 8.5)

NVD · officialPublished Oct 12, 2026Risk 37/100

EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token to run script on preview and access the privileged window.edgeeverDesktop bridge.

Technical details

CVSS

8.5

AV:NetworkAC:LowPR:LowUI:Passive

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source