Is CVE-2026-109557 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109557?

CVE-2026-109557 has a CVSS v3 severity of HIGH (8.7).

Back

CVE-2026-109557

Description

EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP create_notebook, rename_notebook or create_memo tools, running script on drag with access to the desktop bridge's session token.