CVE-2026-74234
Received Received - Intake

XSS in Legora via Mermaid Gray-Matter Front-Matter

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description
Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval() before any SVG sanitization occurs. Attackers can exploit this flaw through influenced Mermaid diagram content to execute arbitrary JavaScript in the user's browser context, with elevated impact on Word and Outlook add-in surfaces where bearer session tokens are persisted in localStorage.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-18
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-74234
EUVD
EUVD-2026-60437

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
legora legora to 2026-08-14 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-95 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Legora before 2026-08-14 has a cross-site scripting flaw where attackers can inject JavaScript via a Mermaid block with a gray-matter JavaScript front-matter directive. This causes the front-matter parser to run eval() before SVG sanitization, allowing arbitrary code execution in a victim's browser.

Detection Guidance

This vulnerability is specific to Legora software versions before 2026-08-14 and involves XSS via Mermaid blocks with JavaScript front-matter. Detection requires checking Legora version and inspecting Mermaid diagram content for malicious JavaScript front-matter directives.

Impact Analysis

Attackers can execute malicious JavaScript in your browser, potentially stealing session tokens or sensitive data. This is especially dangerous in Word and Outlook add-ins where bearer tokens are stored in localStorage, enabling unauthorized access to accounts.

Compliance Impact

The vulnerability could lead to unauthorized data access or exfiltration, violating GDPR and HIPAA requirements for data protection and confidentiality. Legora claims compliance with these standards, but this flaw undermines those safeguards.

Mitigation Strategies

Immediately update Legora to version 2026-08-14 or later. Disable or restrict Mermaid diagram rendering in Legora until updated. Review and sanitize any existing Mermaid content for malicious JavaScript front-matter directives.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74234. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart