EdgeEver Desktop: Navigation allowlist bypass enabling untrusted origin loading

Summary

EdgeEver Desktop 1.6.26 through 1.112.0 uses string-prefix matching to check navigation targets in the main window. An attacker can craft a link with userinfo syntax after the allowed dev-server prefix, for example in a note-template preview, so the main window loads an arbitrary origin. That origin can then access the edgeeverDesktop bridge, which exposes the session token, sidecar RPC and ACP channels. Exploitation requires a user to open the crafted link and is not known to be automated.

Affected

• EdgeEver Desktop 1.6.26 through 1.112.0 (per CVE record and VulnCheck; 1.112.0 treated as last affected, to be verified)
• Default configuration is listed as unaffected by the CNA; the vulnerable condition is the allowlist check in the desktop main process

Fixed in

• Unknown. No fixed version confirmed by the sources checked.
• A commit (6b5027e) is referenced by the CVE record, but its content and release were not verified.

Workaround

• No vendor workaround found.
• Until a fixed build is confirmed: limit desktop use to trusted users, avoid opening note templates or links from unknown sources, and restrict who can create or share templates.
• For self-hosted instances, restrict registration and access to trusted users.

Exploitation

• Not marked as known exploited by the sources checked.
• No public proof of concept found in searches; this does not prove none exists.
• CISA SSVC: exploitation none, automatable no, technical impact partial.
• EPSS 0.00309.

Our recommendation

• Inventory all EdgeEver Desktop installations and identify versions 1.6.26 to 1.112.0.
• Update to the latest EdgeEver Desktop release and verify that it contains the fix before relying on it.
• Until then, restrict desktop use to trusted users and warn users not to open untrusted links or note templates.
• Monitor the vendor repository and the referenced issues for a confirmed fix.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• EdgeEver GitHub repository github.com
• VulnCheck advisory www.vulncheck.com
• Vulnerable source file (index.mjs) github.com
• Referenced commit 6b5027e github.com
• OSV entry osv.dev
• Hol.org CVE summary hol.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:36.