EdgeEver: a note title written through MCP ran script in the desktop app
EdgeEver stored attacker script in note and template fields that any MCP client could write, then ran it inside the privileged desktop app.
· VulnCheck · Research by wgetnz
EdgeEver, an open-source AI notes app with a built-in MCP interface, stored script in notebook names, memo titles and templates and ran it inside the desktop app. VulnCheck assigned two CVEs on October 12. Fixed in v1.113.0.
- vulncheck.comVulnCheck Advisory
- vulncheck.comTemplate XSS Advisory
- github.comHardening Tracker
- +2 sources
01What happened
VulnCheck published two stored cross-site scripting advisories for EdgeEver on October 12, 2026, both credited to the researcher wgetnz. The two reports are part of a larger audit of the EdgeEver desktop client, reports 532 to 543, which the maintainer tracks in issue 546. EdgeEver is an open-source notes and knowledge base app whose README describes a native MCP interface that lets external AI agents read and organize notes.
02How it works
Two unsanitized fields carry the payload into the renderer. Notebook names and memo titles, which the create_notebook, rename_notebook and create_memo MCP tools write, were built into a drag preview as raw HTML, so script ran when a user dragged the item. Template content took a second path: TemplatesPane.tsx passed a template's contentMarkdown to dangerouslySetInnerHTML with no sanitizing, so HTML event handlers in a template fired when it was previewed. In both advisories the script then reaches the privileged window.edgeeverDesktop bridge and the session token it holds.
03Who is affected
Builds up to and including 1.112.0 are affected, from 0.1.0 for the drag preview and from 1.6.0 for the template preview. An attacker needs an API or MCP token, so the exposure is to self-hosted and desktop users whose tokens are held by an agent or shared across accounts. The maintainer states that unrestricted plugin access to the privileged bridge and automatic ACP tool approval remain design choices rather than defects.
04What to do
Update to v1.113.0 or later, which a maintainer comment says carries the fixes; v1.120.0 is the current release. Rotate EdgeEver API and MCP tokens that untrusted content may have reached, and treat a token given to an agent as able to write any note field.
Questions people ask
- Which EdgeEver version fixes CVE-2026-109557 and CVE-2026-109558?
- EdgeEver v1.113.0, released on October 13, 2026, carries the fixes according to a maintainer comment on the tracking issue. Commit 6b5027e hardens the renderer and desktop execution boundaries. VulnCheck's two advisories name no fixed version and link only that commit. The current release is v1.120.0, so upgrading from any build up to 1.112.0 is the action to take.
- Can an AI agent trigger the EdgeEver XSS on its own?
- An agent holding an EdgeEver MCP token can write the fields that carry the payload, because create_notebook, rename_notebook and create_memo set notebook names and memo titles. Execution still needs a person to drag the item or preview the template. VulnCheck rates both flaws as needing low privileges and user interaction, so an agent that handles untrusted content is a plausible delivery path.
- Is plugin access to the EdgeEver desktop bridge fixed as well?
- Plugin access to the privileged bridge is not fixed. The maintainer's tracking issue lists report 537 on unrestricted plugin access and report 539 on automatic ACP tool approval as design decisions rather than defects, and says they should not be described as fixed. The patch commit states that it preserves the trusted plugin and automatic ACP permission models.
Sources 5 links, all fetched
- 1vulncheck.comVulnCheck Advisory
- 2vulncheck.comTemplate XSS Advisory
- 3github.comHardening Tracker
- 4github.comPatch Commit
- 5github.comEdgeEver Releases