CVE-2026-74234 in Legora
Summary
by MITRE • 08/17/2026
Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval() before any SVG sanitization occurs. Attackers can exploit this flaw through influenced Mermaid diagram content to execute arbitrary JavaScript in the user's browser context, with elevated impact on Word and Outlook add-in surfaces where bearer session tokens are persisted in localStorage.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in Legora prior to version 2026-08-14 represents a critical cross-site scripting flaw rooted in the improper handling of front-matter directives within Mermaid diagram blocks. The core technical deficiency lies in the sequence of operations performed by the application's parser, specifically regarding how it processes JavaScript embedded via gray-matter syntax. When an attacker constructs a malicious payload consisting of a Mermaid block prefixed with a specific gray-matter directive containing executable code, the system invokes the eval function to process this front matter before any subsequent sanitization steps are applied. This ordering error is fundamental because standard security practices dictate that input validation and sanitization must occur prior to execution or rendering. By executing the JavaScript contained in the front matter first, Legora effectively bypasses its own SVG sanitization mechanisms, which would otherwise neutralize malicious scripts embedded within visual elements like diagrams.
This architectural flaw allows attackers to achieve arbitrary JavaScript execution within the victim's browser context simply by influencing the content of Mermaid diagrams. The attack vector is particularly insidious because it leverages legitimate features of the platform for malicious purposes. Users who view documents containing these crafted blocks will have their browsers execute the injected code without any warning or additional interaction beyond normal viewing activities. This constitutes a classic stored cross-site scripting scenario where the payload persists in content and triggers upon access, rather than requiring immediate user input like clicking a link. The ability to run arbitrary scripts grants attackers full control over the DOM of the affected page, enabling them to steal sensitive data, modify page content, or perform actions on behalf of the victim.
The operational impact is significantly elevated when this vulnerability occurs within Word and Outlook add-in surfaces due to the specific security context in which these applications operate. In such environments, bearer session tokens are often persisted in localStorage for convenience and seamless authentication across sessions. Because cross-site scripting allows full access to browser storage APIs, an attacker exploiting this flaw can directly read or manipulate data stored in localStorage. This means that sensitive authentication credentials, including long-lived session tokens, become accessible to malicious scripts. The compromise of these tokens enables attackers to hijack user sessions, bypassing traditional authentication controls and gaining unauthorized access to corporate resources, emails, documents, and other protected assets associated with the victim's account.
From a classification perspective, this vulnerability aligns closely with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. More specifically, it reflects CWE-862 Missing Authorization in contexts where session tokens are exposed, and CWE-95 improper neutralization of special elements used in an eval call which leads to command injection or script execution. In terms of the MITRE ATT&CK framework, this exploit maps directly to T1059 Command and Scripting Interpreter via JavaScript for code execution and potentially T1534 Internal Spearphishing if delivered through Word documents within a corporate network. The persistence mechanism relies on storing malicious content in document files that are shared or viewed by other users, facilitating lateral movement or widespread compromise once initial access is gained.
Mitigation strategies must address both the immediate technical flaw and broader security hygiene practices. Legora developers should immediately patch the parser to ensure that all input sanitization occurs before any evaluation of front-matter directives. Implementing a Content Security Policy with strict script-src restrictions can also mitigate the impact by preventing unauthorized JavaScript execution even if an injection succeeds. For users, it is advisable to disable automatic rendering of Mermaid diagrams or gray-matter content until patches are applied and to avoid opening documents from untrusted sources in environments where sensitive tokens are stored locally. Regular security audits focusing on parser logic order and strict input validation protocols will prevent similar vulnerabilities arising from premature execution of user-supplied data.