Tools AI Risk Radar ai-incident-0217
Incident record
EdgeEver preview content can execute scripts in the app
- Severity
- High
- Status
- Research
- Type
- Infra Vuln
- Target
- EdgeEver 1.6.0 through 1.112.0
- Actor
- researcher
- CVE
- CVE-2026-109558
What happened
Researcher reports describe stored cross-site scripting through template previews and drag previews carrying MCP-supplied content. Opening or using the affected preview exposes the application to the injected script.
CVE-2026-109558 covers template preview; CVE-2026-109557 covers the drag preview. The CNA gives both CVSS 3.1 score 8.7. The maintainer’s 12 October statement said the fix was on the main development branch but unreleased; official version 1.112.0 still lacked it when checked on 13 October. Closing the original issues consolidated tracking.
Sources
- Original advisory or disclosuregithub.com/tianma-if/edgeever/issues/546
- CVE recordcveawg.mitre.org/api/cve/CVE-2026-109558
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026