Tools AI Risk Radar ai-incident-0217
Incident record
EdgeEver preview content can execute scripts in the app
- Severity
- High
- Status
- Patched
- Type
- Infra Vuln
- Target
- EdgeEver 1.6.0 through 1.112.0
- Actor
- researcher
- CVE
- CVE-2026-109558
What happened
Researcher reports describe stored cross-site scripting through template previews and drag previews carrying MCP-supplied content. Opening or using the affected preview exposes the application to the injected script.
CVE-2026-109558 covers template preview and CVE-2026-109557 covers drag preview. The CNA gives both CVSS 3.1 score 8.7. EdgeEver released version 1.113.0 on 13 October; the maintainer confirmed that release fixes the preview vulnerabilities. Separate trust decisions around plugins and ACP permissions remain outside that fix.
Sources
- Original advisory or disclosuregithub.com/tianma-if/edgeever/issues/546
- CVE recordcveawg.mitre.org/api/cve/CVE-2026-109558
- Released fix, 1.113.0github.com/tianma-if/edgeever/releases/tag/v1.113.0
- Maintainer confirmationgithub.com/tianma-if/edgeever/issues/546#issuecomment-613984…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026