CVE-2026-109557
8.7 HIGHpublic exploit availablePublished 2026-10-12 · Updated 2026-10-16
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP create_notebook, rename_notebook or create_memo tools, running script on drag with access to the desktop bridge's session token.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-79
Public exploit & PoC references
- https://github.com/tianma-if/edgeever
- https://github.com/tianma-if/edgeever/blob/f6ade70423ba366077653dbb8ac43a677933c776/apps/web/src/lib/app-helpers.ts#L912-L920
- https://github.com/tianma-if/edgeever/commit/6b5027e8b4becbee0c0de7cd1a3d04af78ca87ca
- https://github.com/tianma-if/edgeever/issues/534
- https://github.com/tianma-if/edgeever/issues/546
- https://github.com/tianma-if/edgeever/issues/534
All references
- https://github.com/tianma-if/edgeever
- https://github.com/tianma-if/edgeever/blob/f6ade70423ba366077653dbb8ac43a677933c776/apps/web/src/lib/app-helpers.ts#L912-L920
- https://github.com/tianma-if/edgeever/commit/6b5027e8b4becbee0c0de7cd1a3d04af78ca87ca
- https://github.com/tianma-if/edgeever/issues/534
- https://github.com/tianma-if/edgeever/issues/546
- https://www.vulncheck.com/advisories/edgeever-through-1.112.0-stored-xss-via-setmemodragpreview-drag-preview
- https://github.com/tianma-if/edgeever/issues/534
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2016-20098PoC
- MEDIUMCVE-2023-54408PoC
- UNSCOREDCVE-2023-5648
- MEDIUMCVE-2024-31027
- MEDIUMCVE-2024-34321
- MEDIUMCVE-2024-58391PoC
- MEDIUMCVE-2025-12828
- MEDIUMCVE-2025-13533PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.