CVE-2026-109558

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109558
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109558.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109558
Published
2026-10-12T20:55:13Z
Modified
2026-10-28T02:30:53Z
Severity
  • 8.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
EdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane Template Preview
Details

EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token to run script on preview and access the privileged window.edgeeverDesktop bridge.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109558.json"
}
References

Affected packages

Git / github.com/tianma-if/edgeever

Affected ranges

Type
GIT
Repo
https://github.com/tianma-if/edgeever
Events
Introduced
5423281106f13931ceac44ce1e547ff6f6ba8b38
Fixed
6b5027e8b4becbee0c0de7cd1a3d04af78ca87ca
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "1.6.0"
                },
                {
                    "last_affected": "1.112.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "6b5027e8b4becbee0c0de7cd1a3d04af78ca87ca"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v1.*
v1.10.0
v1.10.1
v1.10.2
v1.100.0
v1.101.0
v1.102.0
v1.103.0
v1.104.0
v1.105.0
v1.106.0
v1.107.0
v1.108.0
v1.109.0
v1.11.0
v1.11.1
v1.110.0
v1.111.0
v1.111.1
v1.112.0
v1.12.0
v1.12.1
v1.12.2
v1.12.3
v1.12.4
v1.12.5
v1.12.6
v1.12.7
v1.12.8
v1.13.0
v1.13.1
v1.13.2
v1.13.3
v1.14.0
v1.14.1
v1.14.2
v1.15.0
v1.15.1
v1.16.0
v1.17.0
v1.17.1
v1.17.2
v1.18.0
v1.18.1
v1.18.2
v1.19.0
v1.19.1
v1.20.0
v1.21.0
v1.21.1
v1.21.2
v1.21.3
v1.21.4
v1.22.0
v1.23.0
v1.23.1
v1.24.0
v1.24.1
v1.24.2
v1.24.3
v1.25.0
v1.26.0
v1.27.0
v1.28.0
v1.28.1
v1.29.0
v1.30.0
v1.30.1
v1.30.2
v1.30.3
v1.31.0
v1.32.0
v1.33.0
v1.34.0
v1.34.1
v1.35.0
v1.35.1
v1.35.2
v1.36.0
v1.37.0
v1.38.0
v1.39.0
v1.40.0
v1.41.0
v1.42.0
v1.42.1
v1.43.0
v1.44.0
v1.45.0
v1.45.1
v1.45.2
v1.45.4
v1.46.0
v1.47.0
v1.48.0
v1.49.0
v1.50.0
v1.51.0
v1.51.1
v1.52.0
v1.53.0
v1.54.0
v1.55.0
v1.56.0
v1.56.1
v1.57.0
v1.58.0
v1.58.1
v1.59.0
v1.6.0
v1.6.1
v1.6.10
v1.6.11
v1.6.12
v1.6.13
v1.6.14
v1.6.15
v1.6.16
v1.6.17
v1.6.18
v1.6.19
v1.6.2
v1.6.20
v1.6.21
v1.6.22
v1.6.23
v1.6.24
v1.6.25
v1.6.26
v1.6.27
v1.6.28
v1.6.29
v1.6.3
v1.6.30
v1.6.31
v1.6.33
v1.6.34
v1.6.35
v1.6.36
v1.6.37
v1.6.38
v1.6.39
v1.6.4
v1.6.40
v1.6.41
v1.6.43
v1.6.44
v1.6.45
v1.6.46
v1.6.47
v1.6.48
v1.6.49
v1.6.5
v1.6.50
v1.6.51
v1.6.52
v1.6.53
v1.6.54
v1.6.6
v1.6.7
v1.6.8
v1.6.9
v1.60.0
v1.61.0
v1.62.0
v1.63.0
v1.63.1
v1.63.2
v1.64.0
v1.64.1
v1.65.0
v1.65.1
v1.66.0
v1.67.0
v1.68.0
v1.69.0
v1.7.0
v1.7.1
v1.7.2
v1.70.0
v1.72.0
v1.73.0
v1.73.2
v1.74.0
v1.75.1
v1.76.0
v1.77.0
v1.78.0
v1.78.1
v1.79.0
v1.8.0
v1.8.1
v1.8.10
v1.8.11
v1.8.12
v1.8.13
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.8.6
v1.8.7
v1.8.8
v1.8.9
v1.80.0
v1.81.0
v1.82.0
v1.83.0
v1.84.0
v1.85.0
v1.86.0
v1.87.0
v1.88.0
v1.89.0
v1.9.0
v1.9.1
v1.9.2
v1.9.3
v1.9.4
v1.90.0
v1.92.0
v1.92.1
v1.93.0
v1.94.0
v1.95.0
v1.96.0
v1.97.0
v1.98.0
v1.99.0
v1.99.1
v1.99.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109558.json"