[CVE-2026-109557] EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview …

Descripción técnica

EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP create_notebook, rename_notebook or create_memo tools, running script on drag with access to the desktop bridge's session token.

Puntuación CVSS

Score: 8.7/10 — Severidad: HIGH — Estado NIST: Received

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Debilidades (CWE)

CWE-79

Fuente oficial

Publicado en NIST NVD.