{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/edgeever/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:edgeever:edgeever:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.7,"id":"CVE-2026-109557"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["EdgeEver (\u003c= 1.112.0)"],"_cs_severities":["high"],"_cs_tags":["web-application","xss","injection","session-hijacking"],"_cs_type":"advisory","_cs_vendors":["EdgeEver"],"content_html":"\u003cp\u003eEdgeEver versions 1.112.0 and earlier are affected by a stored cross-site scripting (XSS) vulnerability located in the setMemoDragPreview function. This vulnerability allows an authenticated attacker to inject arbitrary JavaScript into the application by creating or renaming notebook names and memo titles. The malicious script is stored by the application and subsequently executed when a user initiates a drag-and-drop action on the affected element. Due to the architecture of the application, the execution context includes access to the desktop bridge session token, which could be exfiltrated by an attacker to facilitate session hijacking.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of arbitrary code within the context of the user's session. This poses a significant risk of session token theft, potentially leading to full account compromise. Users of the EdgeEver desktop application across Windows, macOS, and Linux are susceptible if they interact with malicious notebooks or memos created or renamed by an attacker.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the EdgeEver desktop application to a version greater than 1.112.0 immediately once a vendor patch is released.\u003c/li\u003e\n\u003cli\u003eImplement content security policies (CSP) at the application level to restrict the execution of untrusted scripts.\u003c/li\u003e\n\u003cli\u003eMonitor logs for the use of notebook creation or renaming tools that contain non-standard or script-like character patterns in their titles or names.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T22:42:12Z","date_published":"2026-10-12T22:42:12Z","id":"https://feed.craftedsignal.io/briefs/2026-10-edgeever-xss/","summary":"EdgeEver versions 1.112.0 and earlier contain a stored XSS vulnerability in the setMemoDragPreview function that allows for session token theft via malicious notebook or memo titles.","title":"Stored XSS Vulnerability in EdgeEver setMemoDragPreview","url":"https://feed.craftedsignal.io/briefs/2026-10-edgeever-xss/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:edgeever:edgeever_desktop:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8,"id":"CVE-2026-109556"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["EdgeEver Desktop (1.92.0-1.112.0)","EdgeEver Desktop (1.6.26 through 1.112.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","web-application","desktop-app"],"_cs_type":"advisory","_cs_vendors":["EdgeEver"],"content_html":"\u003cp\u003eEdgeEver Desktop versions 1.92.0 through 1.112.0 are vulnerable to remote code execution (RCE) via the desktop:acp-probe inter-process communication (IPC) handler. The vulnerability stems from a failure to perform adequate sender verification in the IPC handler, which subsequently facilitates the execution of a caller-supplied executable path. An attacker who gains control over the renderer process, potentially through stored cross-site scripting (XSS) in components like template-preview or drag-preview, can invoke the probeAcpAdapter function to execute arbitrary local binaries. Successful exploitation allows an attacker to execute code with the full privileges of the user running the EdgeEver Desktop application. This vulnerability is assigned CVE-2026-109556 and represents a significant risk for desktop environments where the application is deployed.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution with the user's permissions. This may lead to full system compromise, data theft, or persistence on the affected host, impacting users of EdgeEver Desktop versions 1.92.0 through 1.112.0 across Windows, macOS, and Linux platforms.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch EdgeEver Desktop to a version beyond 1.112.0 immediately.\u003c/li\u003e\n\u003cli\u003eAudit applications utilizing Electron or similar frameworks for insecure IPC handler configurations and lack of input validation on executable paths.\u003c/li\u003e\n\u003cli\u003eMonitor for unexpected process spawns originating from the EdgeEver Desktop primary application process.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T22:42:29Z","date_published":"2026-10-12T22:42:04Z","id":"https://feed.craftedsignal.io/briefs/2026-10-edgeever-rce/","summary":"EdgeEver Desktop versions 1.92.0 through 1.112.0 contain a remote code execution vulnerability in the desktop:acp-probe IPC handler that allows arbitrary command execution via an insecure probeAcpAdapter function.","title":"Remote Code Execution in EdgeEver Desktop via IPC Handler","url":"https://feed.craftedsignal.io/briefs/2026-10-edgeever-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - EdgeEver","version":"https://jsonfeed.org/version/1.1"}