CVE-2026-109557 [HIGH] – EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDr

EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP create_notebook, rename_notebook or create_memo tools, running script on drag with access to the desktop bridge’s session token.