{"id":"CVE-2026-105293","published":"2026-10-05T01:16:28.780","lastModified":"2026-10-06T16:08:43.180","description":"Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall, and themes.install to launch local executables, recursively delete directories, and write files outside the themes directory.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Legcord/Legcord","tags":[]},{"url":"https://github.com/Legcord/Legcord/blob/v1.3.0/src/common/themes.ts#L269-L276","tags":[]},{"url":"https://github.com/Legcord/Legcord/blob/v1.3.0/src/discord/ipc.ts#L201-L206","tags":[]},{"url":"https://github.com/Legcord/Legcord/issues/1163","tags":[]},{"url":"https://www.vulncheck.com/advisories/legcord-1.1.0-through-1.3.0-path-traversal-via-theme-ipc-handlers","tags":[]}],"exploitRefs":[{"url":"https://github.com/Legcord/Legcord","tags":[]},{"url":"https://github.com/Legcord/Legcord/blob/v1.3.0/src/common/themes.ts#L269-L276","tags":[]},{"url":"https://github.com/Legcord/Legcord/blob/v1.3.0/src/discord/ipc.ts#L201-L206","tags":[]},{"url":"https://github.com/Legcord/Legcord/issues/1163","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows script in the Discord page to traverse paths and execute local commands, leading to potential local file system damage and unauthorized access.","exploitability":"Exploitation requires running script in the Discord origin, such as through XSS, making it moderately difficult to exploit.","blast_radius":"If exploited, attackers could gain significant control over the affected system, including executing arbitrary code and deleting files.","remediation":"Upgrade to Legcord 1.4.0 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","xss","path-traversal"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-06T08:45:33.074Z"}}