Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities by Legcord
CVE-2026-105294 (GCVE-0-2026-105294)
Vulnerability from nvd – Published: 2026-10-05 00:44 – Updated: 2026-10-05 00:44
VLAI
EPSS
VEX
Title
Legcord 1.1.0 through 1.3.0 Chromium Switch Injection via settings.setConfig
Summary
Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.setConfig bridge. Attackers exploiting a Discord XSS can set additionalArguments to persistently add --proxy-server and --ignore-certificate-errors switches, routing all client traffic through an interception proxy.
Severity
7.4 (High)
CWE
- CWE-15 - External Control of System or Configuration Setting
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Legcord/Legcord/issues/1163 | issue-tracking |
| https://github.com/Legcord/Legcord | product |
| https://github.com/Legcord/Legcord/blob/v1.3.0/sr… | technical-description |
| https://github.com/Legcord/Legcord/blob/v1.3.0/sr… | technical-description |
| https://www.vulncheck.com/advisories/legcord-1.1.… | third-party-advisory |
Impacted products
Date Public
2026-08-30 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Legcord",
"vendor": "Legcord",
"versions": [
{
"lessThanOrEqual": "1.3.0",
"status": "affected",
"version": "1.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Siyang Wu"
}
],
"datePublic": "2026-08-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.setConfig bridge. Attackers exploiting a Discord XSS can set additionalArguments to persistently add --proxy-server and --ignore-certificate-errors switches, routing all client traffic through an interception proxy."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-15",
"description": "External Control of System or Configuration Setting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T00:44:19.284Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1163",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Legcord/Legcord/issues/1163"
},
{
"tags": [
"product"
],
"url": "https://github.com/Legcord/Legcord"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Legcord/Legcord/blob/v1.3.0/src/discord/ipc.ts#L296-L299"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Legcord/Legcord/blob/v1.3.0/src/main.ts#L277-L307"
},
{
"name": "VulnCheck Advisory: Legcord 1.1.0 through 1.3.0 Chromium Switch Injection via settings.setConfig",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/legcord-1.1.0-through-1.3.0-chromium-switch-injection-via-settings-setconfig"
}
],
"title": "Legcord 1.1.0 through 1.3.0 Chromium Switch Injection via settings.setConfig",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-105294",
"datePublished": "2026-10-05T00:44:19.284Z",
"dateReserved": "2026-10-05T00:19:08.246Z",
"dateUpdated": "2026-10-05T00:44:19.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105293 (GCVE-0-2026-105293)
Vulnerability from nvd – Published: 2026-10-05 00:44 – Updated: 2026-10-05 14:55
VLAI
EPSS
VEX
Title
Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers
Summary
Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall, and themes.install to launch local executables, recursively delete directories, and write files outside the themes directory.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 14:52 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Legcord/Legcord/issues/1163 | issue-tracking |
| https://github.com/Legcord/Legcord | product |
| https://github.com/Legcord/Legcord/blob/v1.3.0/sr… | technical-description |
| https://github.com/Legcord/Legcord/blob/v1.3.0/sr… | technical-description |
| https://www.vulncheck.com/advisories/legcord-1.1.… | third-party-advisory |
Impacted products
Date Public
2026-08-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105293",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-05T14:52:51.768600Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T14:55:10.466Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Legcord",
"vendor": "Legcord",
"versions": [
{
"lessThanOrEqual": "1.3.0",
"status": "affected",
"version": "1.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Siyang Wu"
}
],
"datePublic": "2026-08-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall, and themes.install to launch local executables, recursively delete directories, and write files outside the themes directory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T00:44:18.687Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1163",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Legcord/Legcord/issues/1163"
},
{
"tags": [
"product"
],
"url": "https://github.com/Legcord/Legcord"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Legcord/Legcord/blob/v1.3.0/src/discord/ipc.ts#L201-L206"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Legcord/Legcord/blob/v1.3.0/src/common/themes.ts#L269-L276"
},
{
"name": "VulnCheck Advisory: Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/legcord-1.1.0-through-1.3.0-path-traversal-via-theme-ipc-handlers"
}
],
"title": "Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-105293",
"datePublished": "2026-10-05T00:44:18.687Z",
"dateReserved": "2026-10-05T00:19:05.720Z",
"dateUpdated": "2026-10-05T14:55:10.466Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105294 (GCVE-0-2026-105294)
Vulnerability from cvelistv5 – Published: 2026-10-05 00:44 – Updated: 2026-10-05 00:44
VLAI
EPSS
VEX
Title
Legcord 1.1.0 through 1.3.0 Chromium Switch Injection via settings.setConfig
Summary
Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.setConfig bridge. Attackers exploiting a Discord XSS can set additionalArguments to persistently add --proxy-server and --ignore-certificate-errors switches, routing all client traffic through an interception proxy.
Severity
7.4 (High)
CWE
- CWE-15 - External Control of System or Configuration Setting
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Legcord/Legcord/issues/1163 | issue-tracking |
| https://github.com/Legcord/Legcord | product |
| https://github.com/Legcord/Legcord/blob/v1.3.0/sr… | technical-description |
| https://github.com/Legcord/Legcord/blob/v1.3.0/sr… | technical-description |
| https://www.vulncheck.com/advisories/legcord-1.1.… | third-party-advisory |
Impacted products
Date Public
2026-08-30 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Legcord",
"vendor": "Legcord",
"versions": [
{
"lessThanOrEqual": "1.3.0",
"status": "affected",
"version": "1.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Siyang Wu"
}
],
"datePublic": "2026-08-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.setConfig bridge. Attackers exploiting a Discord XSS can set additionalArguments to persistently add --proxy-server and --ignore-certificate-errors switches, routing all client traffic through an interception proxy."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-15",
"description": "External Control of System or Configuration Setting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T00:44:19.284Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1163",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Legcord/Legcord/issues/1163"
},
{
"tags": [
"product"
],
"url": "https://github.com/Legcord/Legcord"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Legcord/Legcord/blob/v1.3.0/src/discord/ipc.ts#L296-L299"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Legcord/Legcord/blob/v1.3.0/src/main.ts#L277-L307"
},
{
"name": "VulnCheck Advisory: Legcord 1.1.0 through 1.3.0 Chromium Switch Injection via settings.setConfig",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/legcord-1.1.0-through-1.3.0-chromium-switch-injection-via-settings-setconfig"
}
],
"title": "Legcord 1.1.0 through 1.3.0 Chromium Switch Injection via settings.setConfig",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-105294",
"datePublished": "2026-10-05T00:44:19.284Z",
"dateReserved": "2026-10-05T00:19:08.246Z",
"dateUpdated": "2026-10-05T00:44:19.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105293 (GCVE-0-2026-105293)
Vulnerability from cvelistv5 – Published: 2026-10-05 00:44 – Updated: 2026-10-05 14:55
VLAI
EPSS
VEX
Title
Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers
Summary
Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall, and themes.install to launch local executables, recursively delete directories, and write files outside the themes directory.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 14:52 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Legcord/Legcord/issues/1163 | issue-tracking |
| https://github.com/Legcord/Legcord | product |
| https://github.com/Legcord/Legcord/blob/v1.3.0/sr… | technical-description |
| https://github.com/Legcord/Legcord/blob/v1.3.0/sr… | technical-description |
| https://www.vulncheck.com/advisories/legcord-1.1.… | third-party-advisory |
Impacted products
Date Public
2026-08-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105293",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-05T14:52:51.768600Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T14:55:10.466Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Legcord",
"vendor": "Legcord",
"versions": [
{
"lessThanOrEqual": "1.3.0",
"status": "affected",
"version": "1.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Siyang Wu"
}
],
"datePublic": "2026-08-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall, and themes.install to launch local executables, recursively delete directories, and write files outside the themes directory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T00:44:18.687Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1163",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Legcord/Legcord/issues/1163"
},
{
"tags": [
"product"
],
"url": "https://github.com/Legcord/Legcord"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Legcord/Legcord/blob/v1.3.0/src/discord/ipc.ts#L201-L206"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Legcord/Legcord/blob/v1.3.0/src/common/themes.ts#L269-L276"
},
{
"name": "VulnCheck Advisory: Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/legcord-1.1.0-through-1.3.0-path-traversal-via-theme-ipc-handlers"
}
],
"title": "Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-105293",
"datePublished": "2026-10-05T00:44:18.687Z",
"dateReserved": "2026-10-05T00:19:05.720Z",
"dateUpdated": "2026-10-05T14:55:10.466Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}