Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-105294— Legcord 1.1.0 through 1.3.0 Chromium Switch Injection via settings.setConfig

Quick assessment

Affected
Legcord Legcord
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Legcord 1.1.0 至 1.3.0 版本中存在一个配置注入漏洞，允许通过 桥接接口，在 Discord 页面中执行脚本，从而写入任意配置键。攻击者若利用 Discord 上的 XSS（跨站脚本）漏洞，可将 设置为持久化地添加 和 启动参数，进而将所有客户端流量重定向至一个中间人拦截代理服务器。

CVSS 7.4 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-105294

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Legcord 1.1.0 through 1.3.0 Chromium Switch Injection via settings.setConfig
Source: CVE Program / CVE List V5
Vulnerability Description
Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.setConfig bridge. Attackers exploiting a Discord XSS can set additionalArguments to persistently add --proxy-server and --ignore-certificate-errors switches, routing all client traffic through an interception proxy.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
系统设置或配置在外部可控制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Legcord Legcord 1.1.0 ~ 1.3.0 -

II. Public POCs for CVE-2026-105294

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-105294

请登录查看更多情报信息。

Other References for CVE-2026-105294 (5)

IV. Related Vulnerabilities

Same product: Legcord
Same vendor: Legcord
Same weakness: CWE-15

V. Comments for CVE-2026-105294

No comments yet

Leave a comment