Read the docs

Legcord

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Legcord records in CISA KEV

No Legcord vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-67727 CVE-2026-105293 · GHSA-m6xw-v6hf-7jc2

Path traversal in Legcord theme handlers lets scripts write files

Priority MEDIUM 42

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00375 Published 2026-10-05 No fix listed CWE-22
TI-2026-67728 CVE-2026-105294 · GHSA-3q64-f25r-4v38

Legcord config injection lets page script add Chromium proxy switches

Priority LOW 38

Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.setConfig bridge.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00189 Published 2026-10-05 No fix listed CWE-15
Open these records in search →