Product
Legora versions prior to 2026-08-14 are vulnerable to cross-site scripting via insecure front-matter parsing in Mermaid diagram blocks, allowing arbitrary JavaScript execution and potential session token theft.