CVE-2026-109557: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in tianma-if EdgeEver

CVE-2026-109557 is a stored cross-site scripting vulnerability in the EdgeEver product by tianma-if, affecting versions from 0.1.0 through 1.112.0. The vulnerability exists in the setMemoDragPreview function, where input from notebook names or memo titles is not properly neutralized, allowing attackers to inject and execute arbitrary scripts. Attackers can leverage MCP tools such as create_notebook, rename_notebook, or create_memo to set malicious names. When a user drags the affected notebook or memo, the injected script runs with access to the desktop bridge's session token, potentially compromising session integrity.

Successful exploitation allows attackers to execute arbitrary scripts in the context of the victim's session, potentially leading to session token theft via the desktop bridge. This can result in unauthorized actions performed with the victim's privileges within the application environment. The vulnerability has a high severity score (CVSS 8.4) due to its network attack vector, low attack complexity, and high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to MCP tools that allow notebook or memo creation and renaming to trusted users only. Monitor for suspicious activity involving notebook or memo names and avoid dragging untrusted content within the application.