---
id: CVE-2026-109558
title: >-
  EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting
  vulnerability in TemplatesPane.tsx that renders template contentMarkdown with
  raw HTML via dangerouslySetInnerHTML without sanitization
summary: >-
  EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting
  vulnerability in TemplatesPane.tsx that renders template contentMarkdown with
  raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write
  templates …
severity: high
cvss: 8.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N'
cwe:
  - CWE-79
vendor: tianma-if
product: EdgeEver
affected:
  - EdgeEver >= 1.6.0 <= 1.112.0
published: '2026-10-12'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:18:44.867'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109558'
references:
  - url: 'https://github.com/tianma-if/edgeever'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/tianma-if/edgeever/blob/f6ade70423ba366077653dbb8ac43a677933c776/apps/web/src/components/TemplatesPane.tsx#L150-L158
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/tianma-if/edgeever/commit/6b5027e8b4becbee0c0de7cd1a3d04af78ca87ca
    label: disclosure@vulncheck.com
  - url: 'https://github.com/tianma-if/edgeever/issues/533'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/tianma-if/edgeever/issues/546'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/edgeever-1.6.0-through-1.112.0-stored-xss-via-templatespane-template-preview
    label: disclosure@vulncheck.com
  - url: 'https://github.com/tianma-if/edgeever/issues/533'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00419
epssPercentile: 0.36006
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-13T17:44:07.883024Z'
ingestedAt: '2026-10-12T22:05:40.357Z'
---

## Overview

EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token to run script on preview and access the privileged window.edgeeverDesktop bridge.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.