---
id: CVE-2026-109558
title: >-
  EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting
  vulnerability in TemplatesPane.tsx that renders template contentMarkdown with
  raw HTML via dangerouslySetInnerHTML without sanitization
summary: >-
  EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting
  vulnerability in TemplatesPane.tsx that renders template contentMarkdown with
  raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write
  templates …
severity: high
cvss: 8.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N'
cwe:
  - CWE-79
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T21:17:11.940'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109558'
references:
  - url: 'https://github.com/tianma-if/edgeever'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/tianma-if/edgeever/blob/f6ade70423ba366077653dbb8ac43a677933c776/apps/web/src/components/TemplatesPane.tsx#L150-L158
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/tianma-if/edgeever/commit/6b5027e8b4becbee0c0de7cd1a3d04af78ca87ca
    label: disclosure@vulncheck.com
  - url: 'https://github.com/tianma-if/edgeever/issues/533'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/tianma-if/edgeever/issues/546'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/edgeever-1.6.0-through-1.112.0-stored-xss-via-templatespane-template-preview
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-12T22:05:40.357Z'
---

## Overview

EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token to run script on preview and access the privileged window.edgeeverDesktop bridge.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.