CVE-2026-105293

29th percentile - higher than 29% of all known CVEs

Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. An attacker running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall, and themes.install to launch local executables, recursively delete directories, and write files outside the themes directory.

An attacker can launch arbitrary local executables, delete directories, or write files outside the allowed area, leading to remote code execution and data loss. The risk includes full compromise of the user's system.

Upgrade Legcord to a version newer than 1.3.0 that validates theme ids, and restrict script execution in the Discord page context.