Wgetnz

EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable. Attackers with script execution in a renderer, such as via template-preview or drag-preview stored cross-site scripting, can call probeAcpAdapter to launch local executables with the user's privileges.

EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP create notebook, rename notebook or create memo tools, running script on drag with access to the desktop bridge's session token.

EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token to run script on preview and access the privileged window.edgeeverDesktop bridge.

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels.

**Name of the Vulnerable Software and Affected Versions** HFS2 versions prior to 2.4.1 **Description** A template injection issue exists in the multipart upload handler. Unauthenticated attackers can achieve remote code execution by embedding malicious template syntax within a filename. By crafting a filename that includes a closing template quoting sequence followed by an `exec` macro, the authorization check in the dispatcher is bypassed, allowing the execution of arbitrary commands on the host system. **Recommendations** Update HFS2 to a version newer than 2.4.0.

**Name of the Vulnerable Software and Affected Versions** HFS2 versions 2.4.0 and earlier **Description** An unauthenticated arbitrary file access issue exists due to a lack of an authorization model in the macro dispatcher and a failure in the path resolver to confine absolute paths. This allows unauthenticated attackers to read, write, append, and delete files across any directory accessible by the HFS service account, extending beyond the intended shared folder. By manipulating the template engine, an attacker can compromise the confidentiality, integrity, and availability of the host system. **Recommendations** Update HFS2 to a version later than 2.4.0.

**Name of the Vulnerable Software and Affected Versions** HFS2 versions prior to 2.4.1 **Description** An unauthenticated attacker can cause a complete and persistent loss of availability by sending a single crafted request. This action triggers a hung serving thread that enters a busy loop, rendering the entire file server unresponsive to all clients. The system does not self-recover, requiring a manual restart of the service by an operator to restore functionality. **Recommendations** Update HFS2 to a version later than 2.4.0.