Vulnerability · Published Oct 5, 2026 · Assigned by VulnCheck

CVE-2026-105294Legcord 1.1.0 through 1.3.0 Chromium Switch Injection via settings.setConfig

High 7.4

In plain English

A high-severity security flaw in Legcord from Legcord. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.2%top 91.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.setConfig bridge. Attackers exploiting a Discord XSS can set additionalArguments to persistently add --proxy-server and --ignore-certificate-errors switches, routing all client traffic through an interception proxy.

Affected products (as reported)

Vendor	Product	Versions
Legcord	Legcord	1.1.0 – through 1.3.0

Weakness: CWE-15 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

GitHub Issue #1163 issue-tracking
https://github.com/Legcord/Legcord product
https://github.com/Legcord/Legcord/blob/v1.3.0/src/discord/ipc.ts#L296-L299 technical-description
https://github.com/Legcord/Legcord/blob/v1.3.0/src/main.ts#L277-L307 technical-description
VulnCheck Advisory: Legcord 1.1.0 through 1.3.0 Chromium Switch Injection via settings.setConfig third-party-advisory