CVE-2026-109556 in EdgeEver
Summary
by MITRE • 10/13/2026
EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable. Attackers with script execution in a renderer, such as via template-preview or drag-preview stored cross-site scripting, can call probeAcpAdapter to launch local executables with the user's privileges.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in EdgeEver Desktop versions 1.92.0 through 1.112.0 represents a critical security flaw within the application’s inter-process communication architecture, specifically targeting the desktop:acp-probe IPC handler. This component is designed to facilitate communication between different parts of the desktop environment, but it suffers from a fundamental lack of sender verification. In secure software design, any endpoint that accepts commands or data from other processes must strictly validate the origin and identity of the caller to ensure that only authorized components can trigger sensitive operations. The absence of this check allows any process with access to the IPC channel to invoke the handler without restriction, effectively bypassing internal security boundaries established by the application framework.
The core technical flaw lies in how the acp-probe handler processes incoming requests. Upon receiving a call via probeAcpAdapter, the function directly utilizes caller-supplied input parameters to spawn local executables defined in the path field of the request payload. This behavior constitutes an arbitrary command execution vulnerability because it does not sanitize or validate the executable path provided by the sender. By leveraging this mechanism, an attacker can instruct the application to launch any binary file present on the user’s system with the same privileges as the currently logged-in user. This capability transforms a simple IPC call into a powerful vector for remote code execution, allowing full control over the host environment if the conditions are met.
Exploitation of this vulnerability requires an initial foothold within the application's renderer processes, which typically handle web content rendering and UI interactions. Attackers can achieve this entry point through stored cross-site scripting vulnerabilities located in features such as template-preview or drag-preview modules. Once a malicious script is executed within these renderers due to insufficient input validation on user-supplied data like templates or preview files, the attacker gains access to the JavaScript context that interacts with Electron’s IPC layer. From there, the attacker can construct and send a crafted message to the desktop:acp-probe endpoint, supplying a path to a malicious executable stored locally on the victim's machine. The application then executes this binary without question, leading to complete system compromise under the user's account context.
The operational impact of this vulnerability is severe, as it enables privilege escalation and arbitrary code execution with minimal prerequisites beyond initial script injection. Since EdgeEver Desktop operates with standard user privileges in most configurations, successful exploitation grants attackers the ability to install malware, exfiltrate sensitive data, modify system settings, or pivot further into a network if local credentials are compromised. The reliance on stored XSS vectors makes this vulnerability particularly dangerous because it can be triggered passively when a victim views malicious content within the application’s preview features, requiring no additional user interaction beyond opening the infected template or preview file.
Mitigation strategies must address both the immediate code flaw and the underlying architectural weaknesses. First, developers should implement strict sender verification in all IPC handlers to ensure that only trusted internal modules can invoke critical functions like acp-probe. This involves checking the origin of the message against a whitelist of known safe processes or using secure messaging patterns provided by the framework. Second, input validation must be enforced on all parameters passed to system execution functions, specifically rejecting any path inputs that are not explicitly whitelisted or sanitized for directory traversal and command injection characters. Additionally, restricting file associations and preventing arbitrary executable launches from web content is essential to closing this attack vector.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code Command Injection, as the application constructs system commands based on untrusted input without proper validation. It also relates to CWE-284 Improper Access Control due to the lack of sender verification in the IPC handler. In terms of tactical mapping within the MITRE ATT&CK framework, this exploit leverages T1059 Command and Scripting Interpreter for executing arbitrary code via system commands and potentially T1203 Exploitation for Client Applications if viewed through the lens of initial access via stored XSS. Remediation efforts should prioritize patching to version 1.112.1 or later where these checks are implemented, while interim mitigations include disabling unnecessary IPC channels in renderer contexts and enforcing strict content security policies to prevent script execution from untrusted sources within preview modules.