The impact is particularly severe when Legora is deployed as a Word or Outlook add-in, where the browser session shares the same origin or local storage access as the host application. In these environments, the execution of unauthorized scripts enables the exfiltration of sensitive bearer session tokens persisted in localStorage. Defenders should prioritize patching Legora to version 2026-08-14 or later to remediate the unsafe parsing logic.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the victim's browser, potentially leading to unauthorized access to user data, session hijacking via token theft in Word and Outlook environments, and impersonation of the legitimate user.

Recommendation

• Upgrade all instances of Legora to version 2026-08-14 or later immediately.
• Review browser-based access logs for web-based instances of Legora to identify requests containing atypical Mermaid syntax or front-matter directives.
• Implement Content Security Policy (CSP) headers that restrict the execution of inline scripts and disallow the use of eval() if the application architecture permits.