Description
EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP create_notebook, rename_notebook or create_memo tools, running script on drag with access to the desktop bridge's session token.
Published: 2026-10-12
Score: 8.4 High
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting (XSS)
Action: Immediate Patch
AI Analysis

Impact

EdgeEver versions up to 1.112.0 include a stored cross‑site scripting flaw in the setMemoDragPreview function that allows an attacker to embed malicious script payloads inside notebook names or memo titles. When a user drags an item, the malicious code executes in the context of the desktop bridge, giving the attacker direct access to the session token and the ability to perform further malicious actions. This vulnerability can compromise confidentiality, integrity, and availability of the user's data.

Affected Systems

The affected product is EdgeEver from tianma-if, with all releases up to and including 1.112.0.

Risk and Exploitability

The CVSS score is 8.4, indicating high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw by creating or renaming notebooks or memos through the MCP tools, embedding scripts that run when the item is dragged. The attack requires user interaction but delivers a powerful client‑side execution capability.

Generated by OpenCVE AI on October 12, 2026 at 22:49 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade EdgeEver to the latest release that contains a fix for setMemoDragPreview; review the vendor’s release notes for the patch summary.
  • Restrict or disable the use of drag‑preview functionality for notebooks and memos until a patch is applied, preventing the vulnerable script from executing.
  • Implement input validation or sanitization for notebook names and memo titles on the client and server side to eliminate injection of executable code; consider applying a Content Security Policy that blocks inline scripts.

Generated by OpenCVE AI on October 12, 2026 at 22:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Tianma-if
Tianma-if edgeever
Vendors & Products Tianma-if
Tianma-if edgeever

Mon, 12 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
Description EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP create_notebook, rename_notebook or create_memo tools, running script on drag with access to the desktop bridge's session token.
Title EdgeEver through 1.112.0 Stored XSS via setMemoDragPreview Drag Preview
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 8.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N'}

cvssV4_0

{'score': 8.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Tianma-if Edgeever
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-15T13:53:01.160Z

Reserved: 2026-10-12T19:27:50.670Z

Link: CVE-2026-109557

cve-icon Vulnrichment

Updated: 2026-10-15T13:52:49.656Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T21:17:11.790

Modified: 2026-10-16T18:25:45.343

Link: CVE-2026-109557

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:25:12Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')