CVE-2026-109557: stored XSS — HIGH

CISO Take

EdgeEver through 1.112.0 has a stored cross-site scripting flaw in its memo drag-preview function. Anyone able to call the MCP create_notebook, rename_notebook or create_memo tools can plant script in a notebook name or memo title, and that script runs when a user drags the item and can read the desktop bridge's session token. The CVSS is 8.7 with a changed scope, so the impact reaches beyond the web view into the desktop bridge. There is no EPSS score, no KEV listing, no public exploit and no Nuclei template, so there is no sign of active exploitation yet. Upgrade to a release containing the fix commit 6b5027e, and until then restrict which agents and users can reach the MCP notebook and memo tools and treat all names and titles as untrusted.

Sources:NVDATLASVulnCheck advisoryGitHub (tianma-if/edgeever)

What is the risk?

High severity (CVSS 8.7) with low attack complexity and low privileges, but user interaction (a drag action) is required. Scope change means compromise of the desktop bridge session token, giving high confidentiality and integrity impact. Exploitation likelihood is currently unquantified (no EPSS), with no KEV listing, public exploit or scanner template. Risk is elevated wherever AI agents are allowed to write notebook content through MCP, because a prompt-injected agent can supply the payload without being a malicious user.

How does the attack unfold?

Initial Access

Attacker or a prompt-injected agent calls MCP create_notebook, rename_notebook or create_memo with a script payload as the name or title.

AML.T0053

Execution

A user drags the memo or notebook, and setMemoDragPreview renders the unsanitized name, running the script.

AML.T0011

Credential Access

The script reads the desktop bridge session token available to the page.

AML.T0091.000

Impact

The attacker uses the token to read or modify notes and invoke privileged bridge functions on the victim's behalf.

Initial Access

Attacker or a prompt-injected agent calls MCP create_notebook, rename_notebook or create_memo with a script payload as the name or title.

AML.T0053

Execution

A user drags the memo or notebook, and setMemoDragPreview renders the unsanitized name, running the script.

AML.T0011

Credential Access

The script reads the desktop bridge session token available to the page.

AML.T0091.000

Impact

The attacker uses the token to read or modify notes and invoke privileged bridge functions on the victim's behalf.

How severe is it?

CVSS 3.1

8.7 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 36% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UIRequired

SChanged

CHigh

IHigh

ANone

What should I do?

1 step

1) Upgrade to a version later than 1.112.0 that includes commit 6b5027e (see issues 534 and 546). 2) Until patched, restrict or disable the MCP create_notebook, rename_notebook and create_memo tools, or require human approval for them. 3) Avoid dragging memos or notebooks from untrusted or shared sources. 4) Rotate desktop bridge session tokens after suspected exposure. 5) Audit existing notebook names and memo titles for HTML or script markup such as angle brackets, script tags and event handler attributes. 6) Apply a strict Content Security Policy and sanitize or escape names in the drag preview.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionData LeakageAgentPluginAML.T0011- User Execution AML.T0053- AI Agent Tool Invocation AML.T0091.000- Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks

OWASP LLM Top 10

LLM05-Improper Output HandlingLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-109557?

EdgeEver through 1.112.0 has a stored cross-site scripting flaw in its memo drag-preview function. Anyone able to call the MCP create_notebook, rename_notebook or create_memo tools can plant script in a notebook name or memo title, and that script runs when a user drags the item and can read the desktop bridge's session token. The CVSS is 8.7 with a changed scope, so the impact reaches beyond the web view into the desktop bridge. There is no EPSS score, no KEV listing, no public exploit and no Nuclei template, so there is no sign of active exploitation yet. Upgrade to a release containing the fix commit 6b5027e, and until then restrict which agents and users can reach the MCP notebook and memo tools and treat all names and titles as untrusted.

Is CVE-2026-109557 actively exploited?

No confirmed active exploitation of CVE-2026-109557 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-109557?

1) Upgrade to a version later than 1.112.0 that includes commit 6b5027e (see issues 534 and 546). 2) Until patched, restrict or disable the MCP create_notebook, rename_notebook and create_memo tools, or require human approval for them. 3) Avoid dragging memos or notebooks from untrusted or shared sources. 4) Rotate desktop bridge session tokens after suspected exposure. 5) Audit existing notebook names and memo titles for HTML or script markup such as angle brackets, script tags and event handler attributes. 6) Apply a strict Content Security Policy and sanitize or escape names in the drag preview.

What systems are affected by CVE-2026-109557?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP tool servers, AI-assisted note-taking applications, desktop AI applications.

What is the CVSS score for CVE-2026-109557?

CVE-2026-109557 has a CVSS v3.1 base score of 8.7 (HIGH). The EPSS exploitation probability is 0.42%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP tool serversAI-assisted note-taking applicationsdesktop AI applications

MITRE ATLAS Techniques

AML.T0011User Execution

AML.T0053AI Agent Tool Invocation

AML.T0091.000Application Access Token

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM05, LLM06

What are the technical details?

Original Advisory

EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP create_notebook, rename_notebook or create_memo tools, running script on drag with access to the desktop bridge's session token.

Exploitation Scenario

An attacker with low-privilege access to an EdgeEver workspace, or one who prompt-injects an AI agent connected through MCP, calls rename_notebook or create_memo with a name containing an HTML or script payload. The victim later drags that memo in the interface, the drag preview renders the unsanitized title, and the script executes. The script reads the desktop bridge session token and uses it to access or modify notes and other bridge-exposed functions, or to send the token to an attacker server.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Primary CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.