CVE-2026-105294 in Legcord
Summary
by MITRE • 10/05/2026
Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.setConfig bridge. Attackers exploiting a Discord XSS can set additionalArguments to persistently add --proxy-server and --ignore-certificate-errors switches, routing all client traffic through an interception proxy.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
Legcord versions 1.1.0 through 1.3.0 suffer from a critical configuration injection vulnerability that stems from insufficient validation of data passed through the window.legcord settings.setConfig bridge interface. This architectural flaw allows any script executing within the Discord web page context to write arbitrary values into Legcord's internal configuration keys without proper authorization checks or input sanitization. The core technical issue lies in the exposure of this native API bridge, which serves as a communication channel between the JavaScript environment and the underlying Electron application shell, but fails to restrict access to sensitive system-level settings that control network behavior and security protocols.
The operational impact of this vulnerability is severe because it enables an attacker who has achieved Cross-Site Scripting within Discord to escalate their privileges from mere client-side script execution to full control over the desktop application's runtime environment. By exploiting the setConfig bridge, a malicious actor can inject specific command-line arguments into the application's startup configuration. Specifically, attackers can modify the additionalArguments key to persistently append flags such as --proxy-server and --ignore-certificate-errors. This manipulation effectively reconfigures how Legcord handles network traffic for all subsequent sessions, bypassing standard security mechanisms that would normally prevent unauthorized proxy redirection or certificate validation failures.
The persistence of this attack vector is particularly dangerous because the injected configuration changes are saved to disk rather than being ephemeral session data. Once an attacker successfully injects these arguments via a Discord XSS payload, every future launch of Legcord will automatically route all client traffic through a malicious interception proxy controlled by the attacker. This setup facilitates comprehensive man-in-the-middle attacks where sensitive user data, including authentication tokens, private messages, and personal information transmitted over HTTPS connections, can be intercepted, decrypted using self-signed certificates accepted due to the disabled certificate verification, and exfiltrated without the user's knowledge or consent.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code Command Injection as it involves injecting code-like configuration parameters that alter application behavior in unintended ways. Furthermore, from a threat modeling perspective consistent with MITRE ATT&CK frameworks, this exploit maps to T1053 Scheduled Task/Job and T1071 Application Layer Protocol for persistence and lateral movement via compromised legitimate applications. The ability to modify command-line arguments represents a significant breach of application integrity, allowing attackers to hijack network communications under the guise of a trusted desktop client.
Mitigation strategies must focus on hardening the bridge interface between web content and native features. Developers should implement strict allowlists for configuration keys that can be modified via JavaScript APIs, ensuring that sensitive settings like proxy configurations or certificate validation flags are inaccessible from untrusted contexts. Input validation mechanisms must be enforced to reject any attempts to inject command-line switches through these bridges. Additionally, implementing Content Security Policy restrictions within the Electron renderer processes can limit the execution of unauthorized scripts and reduce the attack surface for XSS-based exploitation vectors that target configuration injection points.