CVE-2026-109558: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in tianma-if EdgeEver

CVE-2026-109558 is a stored cross-site scripting vulnerability affecting EdgeEver versions 1.6.0 through 1.112.0. The issue is located in TemplatesPane.tsx where template contentMarkdown is rendered with dangerouslySetInnerHTML without sanitization, allowing attackers to inject malicious HTML event handlers. Exploitation requires the attacker to write templates through an API or MCP token, which then execute scripts on preview and gain access to the privileged window.edgeeverDesktop bridge, potentially leading to elevated privileges within the application context.

Successful exploitation allows an attacker with API or MCP token access to execute arbitrary scripts in the context of the EdgeEver application preview. This can lead to unauthorized actions via the privileged window.edgeeverDesktop bridge, potentially compromising the application's integrity and confidentiality. The CVSS 4.0 score of 8.5 (high severity) reflects the network attack vector, low attack complexity, and high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict API and MCP token access to trusted users only and avoid previewing untrusted templates. Monitor vendor channels for updates regarding patches or official mitigations.