HIGH 8.4 NVD
CVE-2026-109559
EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix U
EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels.
References
- https://github.com/tianma-if/edgeever
- https://github.com/tianma-if/edgeever/blob/f6ade70423ba366077653dbb8ac43a677933c776/apps/d
- https://github.com/tianma-if/edgeever/commit/6b5027e8b4becbee0c0de7cd1a3d04af78ca87ca
- https://github.com/tianma-if/edgeever/issues/536
- https://github.com/tianma-if/edgeever/issues/546
This high severity vulnerability with a CVSS score of 8.4 was published on 2026-10-12 via NVD.
vulnfeed aggregates 11052 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.