Reported by 2 outlets
Legcord Discord client sandbox escape CVE-2026-105293 and CVE-2026-105294
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.60 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
Legcord open-source Discord client has two CVEs: CVE-2026-105293 (CVSS 8.1) and CVE-2026-105294. The theme IPC handlers fail to sanitize paths, allowing XSS in the Discord page to escalate through path traversal to remote code execution. A script running in the Discord page can break out of the Electron sandbox entirely, leading to persistent traffic interception. Both CVEs are tied to the same sandbox-escape chain. No exploitation in the wild is reported, but the unauthenticated path and full sandbox break make it a serious client-side vulnerability for users running Legcord.
Timeline
-
original reporting
If you use Legcord as your Discord client, a script running in the Discord page can break out of the Electron sandbox entirely. CVE-2026-105
dev.to · 8d ago · October 5th, 2026
If you use Legcord as your Discord client, a script running in the Discord page can break out of the Electron sandbox entirely. CVE-2026-105
via Mastodon https://dev.to/threataft_dev/legcord-discord-client-2-cves-xss-in-discord-page-becomes-rce-persistent-traffic-interception-4cll
-
update from threataft.com
Legcord (open-source Discord client) — 2 CVEs CVE-2026-105293 (8.1): theme IPC handlers don't sanitize ../ Discord-page XSS → path traversal
threataft.com · 8d ago · October 5th, 2026
Legcord (open-source Discord client) — 2 CVEs CVE-2026-105293 (8.1): theme IPC handlers don't sanitize ../ Discord-page XSS → path traversal
via Mastodon https://threataft.com/articles/legcord-cluster-cve-2026-105293-105294