Vulnerability DatabaseCVE-2026-109556
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-109556
Published:October 12, 2026
Updated:October 13, 2026
EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable. Attackers with script execution in a renderer, such as via template-preview or drag-preview stored cross-site scripting, can call probeAcpAdapter to launch local executables with the user's privileges.
Affected Packages
https://github.com/tianma-if/edgeever.git (GITHUB):
Affected version(s) =v1.112.0 <v1.113.0
Fix Suggestion:
Update to version v1.113.0
Related Resources (7)
https://github.com/tianma-if/edgeever/commit/6b5027e8b4becbee0c0de7cd1a3d04af78ca87ca
https://github.com/tianma-if/edgeever/issues/546
https://nvd.nist.gov/vuln/detail/CVE-2026-109556
https://github.com/tianma-if/edgeever
https://github.com/tianma-if/edgeever/issues/532
https://github.com/tianma-if/edgeever/blob/f6ade70423ba366077653dbb8ac43a677933c776/apps/desktop/src/main/acp-host.mjs#L1145
https://www.vulncheck.com/advisories/edgeever-desktop-1.92.0-through-1.112.0-local-program-execution-via-acp-ipc
Do you need more information?
Contact Us
CVSS v4
Base Score:
7.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
LOW
User Interaction
ACTIVE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
8
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
Exposed Dangerous Method or Function
CWE-749
EPSS
Base Score:
0.51