EUVD-2026-97880
GHSA-489r-rjvf-hwg5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain access to MCP tools
-
DeliveryInject payload via notebook name or memo title
-
ExploitVictim drags item triggering setMemoDragPreview
-
ExecutionScript executes in desktop bridge context
-
ImpactSteal/abuse session token
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to be able to invoke EdgeEver's MCP tools (create_notebook, rename_notebook, or create_memo) to store a script payload in a notebook name or memo title, and a victim user must subsequently drag that memo or notebook, triggering the unsanitized setMemoDragPreview drag-preview rendering. Limiting factors: the attacker needs privilege to call the MCP tools (PR:L, not unauthenticated), success depends on the victim performing the drag interaction (UI:A), and payoff is scoped to the desktop bridge's session token within the EdgeEver desktop/web app. Affected builds are EdgeEver through 1.112.0. |
| Impact | The CVSS 4.0 base score of 8.4 (vector AV:N/AC:L/AT:N/PR:L/UI:A) overstates real-world urgency for most environments. Signal-by-signal: the attack is network-reachable (AV:N) with low complexity (AC:L) and no special attack requirements (AT:N), but it requires some privilege level (PR:L - the attacker must be able to invoke the MCP create_notebook/rename_notebook/create_memo tools) and active victim interaction (UI:A - a user must drag the poisoned memo/notebook to fire setMemoDragPreview). Impact is high to confidentiality and integrity (VC:H/VI:H) with no scope change to other systems (SC/SI/SA:N), consistent with theft/abuse of the desktop bridge session token within the app. No EPSS score is provided, the CVE is NOT in CISA KEV, and no POC is referenced, so there is no public exploitation signal. The practical risk is therefore moderate-and-conditional rather than a drop-everything priority: it is a stored XSS in an obscure Electron-based desktop application that needs both MCP tool access and a user drag action to succeed. Note a data caveat: the single commit diff supplied as source-code evidence (6b5027e…) concerns ACP adapter path validation (acp-path-store.mjs / acp-host.mjs), not the referenced vulnerable sink in apps/web/src/lib/app-helpers.ts L912-920 - the fix linkage to setMemoDragPreview is not clearly demonstrated by the provided diff and should be verified against the vendor advisory. |
| Exploit ScenarioDerived | An attacker who can reach EdgeEver's MCP tool interface uses create_notebook, rename_notebook, or create_memo to set a notebook name or memo title containing a malicious script payload. When a legitimate user later drags that memo or notebook, the setMemoDragPreview code renders the attacker-controlled name unsanitized, executing the script in the app context with access to the desktop bridge's session token. No public exploit code is referenced, and exploitation requires the victim's drag interaction (UI:A). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Stored cross-site scripting in EdgeEver through 1.112.0 lets authenticated users who can invoke the application's MCP tools (create_notebook, rename_notebook, create_memo) plant a script payload inside a notebook name or memo title, which is then rendered unsanitized by setMemoDragPreview when the item is dragged, executing attacker script in the app context with access to the desktop bridge's session token. Exploitation requires the victim to perform the drag interaction (UI:A) and the attacker to already hold the privilege needed to call the MCP tools (PR:L), so the payoff is scoped to the desktop bridge session token in affected builds; no public exploit code or confirmed active exploitation was identified at time of analysis. The supplied CVSS 4.0 score of 8.4 overstates real-world urgency for most environments, consistent with the independent assessment's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N), which frames this as a moderate-priority authenticated-attacker issue rather than an unauthenticated emergency.
RemediationAI
Patch status is 'upstream fix available (PR/commit); released patched version not independently confirmed': no vendor-tagged release version that fixes this CVE is present in the supplied data, which instead points to the fix commit at https://github.com/tianma-if/edgeever/commit/6b5027e8b4becbee0c0de7cd1a3d04af78ca87ca and to issues https://github.com/tianma-if/edgeever/issues/534 and https://github.com/tianma-if/edgeever/issues/546, so upgrade past 1.112.0 to the first EdgeEver release the vendor confirms contains the fix, and validate the drag-preview escaping change before rollout, since the supplied commit diff modifies desktop ACP IPC path validation rather than setMemoDragPreview. Pending a patched build, the highest-leverage compensating control is to close the injection channel by restricting who can invoke the MCP tools create_notebook, rename_notebook and create_memo - bind the MCP server to localhost, require authentication for it, or disable those tools entirely if automation is not needed - with the trade-off of losing programmatic notebook/memo automation. As a second layer, sanitize or reject notebook names and memo titles containing HTML metacharacters at ingestion or render them as text content instead of markup (strip '<', '>' and event-handler attributes), accepting that legitimate names containing markup will be altered or rejected. Operationally, avoid dragging untrusted notebooks or memos until patched, and because the payoff is the desktop bridge session token, clear/rotate that token and restart the desktop app after any suspected exposure; keep monitoring the vendor advisory at https://www.vulncheck.com/advisories/edgeever-through-1.112.0-stored-xss-via-setmemodragpreview-drag-preview and the project repository for the tagged fix release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
EdgeEver is an Electron-style notebook/memo application whose desktop bridge brokers privileged operations to the renderer and authenticates those calls with a session token; an MCP tool surface exposes create_notebook, rename_notebook and create_memo, giving programmatic creation and renaming of notebooks and memos. The defect is CWE-79 (improper neutralization of input during web page generation): user-controlled strings - notebook names and memo titles - are interpolated into the drag preview built by setMemoDragPreview in apps/web/src/lib/app-helpers.ts (lines 912-920) without escaping, so HTML/script content stored in the name is parsed and executed by the renderer at drag time instead of being displayed as inert text. Because that code runs in the application's own origin and context, the injected script inherits the renderer's privileges and can reach the desktop bridge, including its session token, which is why impact is rated high for confidentiality and integrity rather than as a cosmetic defacement. No CPE strings were supplied in the available intelligence, so scope is taken from the description and repository evidence covering the web client and desktop build through 1.112.0. Note that the referenced upstream commit 6b5027e8b4becbee0c0de7cd1a3d04af78ca87ca, as shown in the supplied diff, changes ACP adapter path handling and IPC authorization in apps/desktop/src/main (introducing acp-path-store.mjs and the desktop:acp-choose-path handler) rather than the drag-preview rendering path, so the exact fixed release for this CVE cannot be confirmed from that diff alone; advisory-level fix tracking runs through issues #534 and #546.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Attacker needs MCP tool access to store the payload (PR:L) and a victim drag action (UI:R); token theft yields C:H/I:H with no availability impact and no scope change.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP create_notebook, rename_notebook or create_memo tools, running script on drag with access to the desktop bridge's session token.
Executive ViewAI
EdgeEver versions up to 1.112.0 contain a stored cross-site scripting flaw that allows authenticated users with access to MCP tools to embed malicious scripts in notebook names and memo titles, which execute when another user drags the affected item and can expose the desktop bridge session token. While the vulnerability requires an authenticated attacker and victim interaction, and no public exploit has been identified, it poses a moderate risk to organizations using EdgeEver for sensitive work. Leadership should prioritize restricting MCP tool privileges and monitoring for suspicious content until a vendor patch is released.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting MCP tool access to trusted users, auditing and sanitizing existing notebook names and memo titles, disabling drag-and-drop if feasible, rotating desktop bridge session tokens, enabling detailed logging for MCP tool invocations, and educating users about the risks of dragging items from untrusted notebooks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB