Vulnerabilidades de Tianma-if
CVEs publicadas que afetam produtos de Tianma-if: 5 registro(s), com severidade, exploração e correções.
CVE-2026-109559
Alta · 8.7
CWE-863 12/10/2026
EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate
EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels.
CVE-2026-109558
Alta · 8.7
CWE-79 12/10/2026
EdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane Template Preview
EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token to run script on preview and access the privileged window.edgeeverDesktop bridge.
CVE-2026-109557
Alta · 8.7
CWE-79 12/10/2026
EdgeEver through 1.112.0 Stored XSS via setMemoDragPreview Drag Preview
EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP create_notebook, rename_notebook or create_memo tools, running script on drag with access to the desktop bridge's session token.
CVE-2026-109556
Alta · 8.0
CWE-749 12/10/2026
EdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execution via ACP IPC
EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable. Attackers with script execution in a renderer, such as via template-preview or drag-preview stored cross-site scripting, can call probeAcpAdapter to launch local executables with the user's privileges.
CVE-2026-108727
Média · 4.3
CWE-862 11/10/2026
EdgeEver through 1.108.0 Missing Authorization via Memo-Template API Routes
EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows holders of scoped API tokens to bypass token scope restrictions because template handlers never call requireScopes. Attackers with a token lacking write:memos can save a template and invoke POST /api/v1/templates/:id/use to create memos, and list, modify, or delete templates in the token owner's workspace.