CVE-2026-109557— EdgeEver through 1.112.0 Stored XSS via setMemoDragPreview Drag Preview
Quick assessment
Affected
tianma-if EdgeEver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
EdgeEver 1.112.0 及更低版本中存在一个存储型跨站脚本漏洞（Stored Cross-Site Scripting, XSS），位于 函数中。攻击者可以通过笔记本名称或备忘录标题注入恶意脚本。攻击者能够利用 MCP（Model Context Protocol）中的 、 或 工具设置恶意的名称。当触发拖拽操作时，这些脚本将得以执行，从而获取访问桌面桥（desktop bridge）会话令牌的能力，可能导致敏感信息泄露或其他安全风险。
Possible ATT&CK Techniques 3 AI
T1189 · Drive-by Compromise T1556.006 · Multi-Factor Authentication T1059.007 · JavaScript
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109557
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
EdgeEver through 1.112.0 Stored XSS via setMemoDragPreview Drag Preview
Source: CVE Program / CVE List V5
Vulnerability Description
EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP create_notebook, rename_notebook or create_memo tools, running script on drag with access to the desktop bridge's session token.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-109557
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109557
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-109557 (1)
Proof of Concept for CVE-2026-109557 (1)
Other References for CVE-2026-109557 (1)
Same Patch Batch · tianma-if · 2026-10-12 · 4 CVEs total
| CVE-2026-109558 | 8.7 HIGH | EdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane Template Preview |
| CVE-2026-109559 | 8.7 HIGH | EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate |
| CVE-2026-109556 | 8.0 HIGH | EdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execution via ACP IPC |
IV. Related Vulnerabilities
Same product: EdgeEver
-
CVE-2026-109558
EdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane -
CVE-2026-109559
EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist -
CVE-2026-109556
EdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execut -
CVE-2026-108727
EdgeEver through 1.108.0 Missing Authorization via Memo-Temp
Same vendor: tianma-if
-
CVE-2026-109558
EdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane -
CVE-2026-109559
EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist -
CVE-2026-109556
EdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execut -
CVE-2026-108727
EdgeEver through 1.108.0 Missing Authorization via Memo-Temp
Same weakness: CWE-79
-
CVE-2026-104250
unstructured: Stored XSS via unescaped HTML generation -
CVE-2026-55562
Cronicle: Stored XSS in admin Activity Log via account full_ -
CVE-2026-102989
TanStack Router: Unauthenticated reflected XSS in TanStack S -
CVE-2026-49264
OAuthLib: Unsafe JSONP callback injection in RevocationEndpo -
CVE-2026-102982
Plane: XSS in work item comments
V. Comments for CVE-2026-109557
No comments yet