EUVD-2026-60437
GHSA-7m72-pf24-w743
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered XSS with scope change to Office add-in token surfaces; AC:H and UI:R reflect content-influence requirement plus victim render; PR:L for content-submission access.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval() before any SVG sanitization occurs. Attackers can exploit this flaw through influenced Mermaid diagram content to execute arbitrary JavaScript in the user's browser context, with elevated impact on Word and Outlook add-in surfaces where bearer session tokens are persisted in localStorage.
AnalysisAI
Cross-site scripting in Legora before 2026-08-14 allows attackers with content-submission access to execute arbitrary JavaScript in victims' browsers by exploiting an eval() call in the gray-matter JavaScript front-matter parser, which fires before Mermaid SVG sanitization runs. The impact is materially elevated on Word and Outlook add-in surfaces where bearer session tokens are persisted in localStorage, enabling session hijacking beyond the browser context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have low-privilege access sufficient to submit or influence Mermaid diagram content within the Legora application (CVSS 4.0 PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 5.1 reflects meaningful real-world friction: high attack complexity (AC:H) and passive user interaction (UI:P) are genuine exploitation barriers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with low-privilege access to submit or influence Mermaid diagram content crafts a block prefixed with a gray-matter JavaScript front-matter directive containing malicious JavaScript. When a victim passively renders the diagram within Legora, the gray-matter parser invokes eval() on the front-matter payload before sanitization, executing the injected script in the victim's browser context. … |
| Remediation | Upgrade Legora to the version released on or after 2026-08-14, which remediates this vulnerability per the VulnCheck advisory at https://www.vulncheck.com/advisories/legora-2026-08-14-xss-via-mermaid-gray-matter-javascript-engine. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-95 – Eval Injection
View allShare
External POC / Exploit Code
Leaving vuln.today