cyfenced.com →

[ CVE-2026-109559 · Published 12 Oct 2026 ]

Vulnerability in tianma-if EdgeEver

CVSS 8.7 EPSS <1%No fix listed yet

[ Description ]Official description

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References