EdgeViewer Desktop XSS via unsanitized marked renderer and dangerouslySetInnerHTML leading to Session Token Theft

Vulnerability Overview Vulnerability ID: vuln-0046 Severity: CRITICAL Discovery Time: 2026-10-11 01:37:28 UTC Target: EdgeViewer Desktop (webgeever/desktop_1.108.0) Endpoint: resources/web/assets/templatesPane-PGnEW8Fh.js Method: GET CVE: CVE-79 CVSS: 10.0 Confidence: Medium Fix Effort: Low Description: EdgeViewer Desktop renders Markdown for note templates using an unsanitized parser and injects the result into the DOM via React's . The template's contains raw HTML (e.g., ), allowing script execution within the application's renderer process. Since the renderer is a window carrying the desktop session, the preload bridge and script execution grant permissions equivalent to those of the desktop process: session-token readout, arbitrary backend RPC calls, local file read/write, and API-base reconfiguration. Template content is scoped to the workspace, synchronized, and cached by any workspace member; therefore, payloads are delivered to victims through normal synchronization. Impact Scope A workspace member (or a configured/malicious configuration instance) stores a crafted template. When a victim opens the template preview, the script executes within the victim's desktop application. From the attacker's code, it is possible to obtain the current session token ( ), synchronize IPC calls and use them against the victim, invoke arbitrary sidecar RPC calls ( ) to create, modify, or delete any notes, attachments, templates, or account records, read local staged files ( , ), place the client into an attacker-controlled state ( ), and drive the ACP adapter / global-shortcut service. This constitutes a complete compromise of the desktop client without any visual alert. Remediation 1. Never pass parsed Markdown directly to : All Markdown to HTML conversions should pass through a hardened renderer that sanitizes the result before it reaches the DOM, including elements, attributes, and URL schemes. The project already provides a hardened pipeline for AI responses ( + ), which can be reused or mirrored in the streamdown vendor bundle for template and Markdown instantiation. 2. Apply this strategy at the boundary: Do not apply the same -> pattern per invocation point, as this pattern exists across multiple components in the renderer bundle. Shared helpers help prevent re-introduction. 3. Handle synchronized and remote template content: Treat as untrusted input and strip HTML from in the sidebar template creation/update/template cache handlers and the instantiation of the endpoint, ensuring that malicious users never reach the client. 4. Add a tester: Assert that , , , and do not produce any event handler attributes, scriptable URLs, or inline scripts/sources post-rendering. 5. As a defense-in-depth measure, provide a restrictive to the renderer document (including , , and handlers), such as with no , so that script injection does not take effect in this case, even if the renderer pipeline is overlooked. Note that this cannot fully resolve the issue through fix alone—sanitization is required. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

EdgeViewer Desktop XSS via unsanitized marked renderer and dangerouslySetInnerHTML leading to Session Token Theft

More from this source