CVE-2026-105294 Legcord CVE debrief

Who should care

Defenders responsible for Legcord deployments, Discord page administrators, and security teams should assess exposure and implement compensating controls to monitor and block unauthorized traffic.

Why it matters

CVE-2026-105294 is a configuration injection vulnerability in Legcord versions 1.1.0 through 1.3.0. This vulnerability allows an attacker to inject scripts via the Discord page, enabling them to write any config key using the window.legcord.settings.setConfig bridge. Consequently, attackers can exploit a Discord XSS to set additionalArguments, which can add --proxy-server and --ignore-certificate-errors switches. This enables routing all client traffic through an interception proxy. Defenders should prioritize verifying Legcord versions and assessing exposure, reviewing configurations for suspicious changes, and implementing compensating controls to monitor and block unauthorized traffic.

• Verify Legcord configurations for suspicious changes
• Implement compensating controls to monitor and block unauthorized traffic
• Restrict access to Discord page and Legcord settings
• Assess exposure and prioritize remediation

Technical summary

The configuration injection vulnerability in Legcord versions 1.1.0 through 1.3.0 allows an attacker to inject scripts via the Discord page, enabling them to write any config key using the window.legcord.settings.setConfig bridge. This can be exploited via a Discord XSS to set additionalArguments, adding --proxy-server and --ignore-certificate-errors switches, and routing all client traffic through an interception proxy.

Defensive priority

Defenders should prioritize verifying Legcord versions and assessing exposure, reviewing configurations for suspicious changes, and implementing compensating controls to monitor and block unauthorized traffic.

Recommended defensive actions

• Verify Legcord versions and assess exposure
• Review configurations for suspicious changes
• Implement compensating controls to monitor and block unauthorized traffic
• Restrict access to Discord page and Legcord settings
• Perform asset inventory of Legcord deployments
• Monitor for unauthorized changes to Legcord configurations
• Track and review logs for suspicious activity

Evidence notes

The CVE record and NVD entry provide details on the configuration injection vulnerability in Legcord. However, the corpus does not establish versions beyond 1.1.0 through 1.3.0, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.