The vulnerability is a stored cross‑site scripting flaw in the TemplatesPane component of EdgeEver. Templates that contain raw HTML, including event handlers, are rendered with dangerouslySetInnerHTML without sanitization. An attacker who can submit a template—through the public API or by exploiting an MCP token—can embed malicious JavaScript that executes in the context of the template preview. Because the preview window has access to the privileged window.edgeeverDesktop bridge, the attacker may read or manipulate desktop‑level data, hijack user sessions, or install persistence.

This issue affects EdgeEver versions 1.6.0 through 1.112.0, distributed by tianma‑if. Users running any of these releases are vulnerable unless they have already applied a newer patch or disabled the vulnerable rendering path.

The flaw has a CVSS score of 8.5, indicating high severity. The EPSS score is unavailable, and EdgeEver is not listed in the CISA KEV catalog. Attackers can exploit the flaw by creating or modifying a template via the exposed API or by using a compromised MCP token. The malicious script runs in the template preview context, giving the attacker privileged access to the window.edgeeverDesktop bridge and enabling arbitrary code execution on the victim’s machine. Given the lack of public exploit coverage and the high impact, organizations should treat this as a critical vulnerability that requires timely remediation.