CVE-2026-109558: EdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane Template Preview
EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token to run script on preview and access the privileged window.edgeeverDesktop bridge.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker needs the ability to write a template containing malicious HTML event handlers. The described paths for doing so are through an API or an MCP token.
When does the malicious script execute?
The script executes when the stored template is rendered in the TemplatesPane preview. Exploitation therefore requires a user to preview the attacker-controlled template.
What could a successful exploit access?
A successful exploit can run script in the preview context and access the privileged window.edgeeverDesktop bridge. The reported impact includes high confidentiality and integrity impact, while availability impact is not indicated.
Which EdgeEver versions are affected?
EdgeEver versions 1.6.0 through 1.112.0 are identified as affected.