{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/legora/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-74234"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Legora"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Legora"],"content_html":"\u003cp\u003eLegora versions released prior to 2026-08-14 contain a critical cross-site scripting (XSS) vulnerability related to the handling of Mermaid diagram blocks. The application utilizes a front-matter parser that improperly invokes the eval() function on diagram content prefixed with JavaScript front-matter directives before any SVG sanitization is performed. This flaw allows attackers to execute arbitrary JavaScript within the context of the victim's browser session.\u003c/p\u003e\n\u003cp\u003eThe impact is particularly severe when Legora is deployed as a Word or Outlook add-in, where the browser session shares the same origin or local storage access as the host application. In these environments, the execution of unauthorized scripts enables the exfiltration of sensitive bearer session tokens persisted in localStorage. Defenders should prioritize patching Legora to version 2026-08-14 or later to remediate the unsafe parsing logic.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of arbitrary JavaScript in the victim's browser, potentially leading to unauthorized access to user data, session hijacking via token theft in Word and Outlook environments, and impersonation of the legitimate user.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of Legora to version 2026-08-14 or later immediately.\u003c/li\u003e\n\u003cli\u003eReview browser-based access logs for web-based instances of Legora to identify requests containing atypical Mermaid syntax or front-matter directives.\u003c/li\u003e\n\u003cli\u003eImplement Content Security Policy (CSP) headers that restrict the execution of inline scripts and disallow the use of eval() if the application architecture permits.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-17T20:50:49Z","date_published":"2026-08-17T20:50:49Z","id":"https://feed.craftedsignal.io/briefs/2026-08-legora-xss/","summary":"Legora versions prior to 2026-08-14 are vulnerable to cross-site scripting via insecure front-matter parsing in Mermaid diagram blocks, allowing arbitrary JavaScript execution and potential session token theft.","title":"Cross-Site Scripting Vulnerability in Legora via Mermaid Blocks","url":"https://feed.craftedsignal.io/briefs/2026-08-legora-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Legora","version":"https://jsonfeed.org/version/1.1"}