Legcord vulnerabilities
We track 2 vulnerabilities in Legcord products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 5, 2026.
2vulnerabilities
0critical
2high
0exploited
7.8average CVSS score
Latest Legcord vulnerabilities
- 7.4 High severity
Legcord: External Control of System or Configuration Setting
Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.setConfig bridge. Attackers exploiting a Discord XSS can set additionalArguments to pers
- 8.1 High severity
Legcord: Improper Limitation of a Pathname to a Restricted Directory
Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can