CVE-2026-109556 is a high severity code execution flaw (CVSS 8.0) in EdgeEver Desktop 1.92.0 through 1.112.0. The desktop:acp-probe IPC handler starts a caller supplied executable without checking the sender, so script running in a renderer can launch local programs. The record names no fixed version.
What's affected
The record says EdgeEver Desktop 1.92.0 through 1.112.0 is affected, and VulnCheck's advisory, which we fetched, says the same range. Neither names a fixed version. The record links a patch commit in the project repository and two issues, number 532 and 546. Check the repository releases for a build newer than 1.112.0 that includes the commit.
The weakness is CWE-749, exposed dangerous method or function. The record's vector is network reachable, high attack complexity, low privileges and user interaction, with changed scope and high impact on confidentiality, integrity and availability. VulnCheck gives a CVSS 4.0 score of 7.3, below the 8.0 in the record.
The record describes the handler desktop:acp-probe, which lacks a sender check and spawns an executable whose path comes from the caller's input. It says an attacker with script execution in a renderer, for example through a stored cross-site scripting issue in the template preview or drag preview features, can call the probe function to launch local executables with the user's privileges.
So the flaw needs a way to run script inside the app first. That is a second stage, and the record names the first stage.
How to check if you're exposed
Find the version in the application's About screen, or in the installation folder, and compare it with 1.92.0 through 1.112.0.
For a team deployment, list which machines have the desktop application installed, using your endpoint inventory. Desktop clients of note taking and knowledge tools are often installed by individuals.
Then think about the first stage. The record mentions template preview and drag preview as ways to get script into a renderer. If your users open templates or shared content from others, the first stage is easier to reach. If they only use their own content, it is harder.
Look at the repository issues and the patch commit linked in the record, and read the release notes for a note on the IPC change.
What to do now
- Update EdgeEver Desktop to a release after 1.112.0 that contains the patch commit, once the project publishes one.
- Until then, avoid opening templates or shared content from untrusted sources in the desktop app.
- Use application control or endpoint protection that flags unexpected child processes launched by the app.
- Keep the application account without administrator rights.
- If you maintain the code, validate the sender of every IPC message and allow only known executable paths.
Why it matters
Desktop applications built with web technology have two worlds: web content in a renderer, and the main process with operating system access. The line between them is the IPC channel, and each handler on the main side is an entry point that renderer script can call. Handlers that start programs are the most dangerous.
The record says this handler had no check on who sent the message and trusted a path from the caller. Any script that runs in a renderer can ask the main process to run an executable. That is why stored cross site scripting in a preview feature becomes more than a nuisance: it can reach the operating system.
Two good habits would have stopped it: verifying the sender frame and URL on every IPC message, and never taking an executable path from the renderer. The same pair of habits applies to any app of this type. The record does not mark this CVE as known exploited.
Quick check
Does this need a first bug?
Yes. The record says the attacker needs script execution in a renderer, such as through a stored cross site scripting issue in a preview feature.
Is there a fixed version?
The record names none. It links a patch commit and issues in the project repository.
Sources
You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your packages carry known CVEs.
Last reviewed: 18 October 2026.
