Legcord EUVD-2026-92158

Exploitation is strictly gated on a pre-existing cross-site scripting vulnerability in the Discord web page loaded by Legcord - the attacker needs script execution in that renderer context to reach the exposed window.legcord settings.setConfig IPC bridge (this is the AT:P attack requirement). The concrete injection target is the additionalArguments config key, into which --proxy-server and --ignore-certificate-errors Chromium command-line switches are written. Key limiting factors: (1) an independent Discord XSS must already exist and be exploitable; (2) the injected switches are launch-time Chromium arguments, so a client restart is generally required before the proxy/cert-bypass takes effect; (3) impact is confined to users running the vulnerable Legcord Electron client versions 1.1.0-1.3.0. These conditions mean the flaw is a privilege-escalation/impact-amplification primitive rather than a standalone remote compromise.

The input assigns a CVSS 4.0 base score of 9.1 (Critical), but the vector itself tempers real-world urgency: AC:H and AT:P mean exploitation is not self-contained - it requires a pre-existing, independent cross-site scripting flaw in Discord's web content before the setConfig bridge can be abused. PR:N/UI:N confirm that once that XSS prerequisite is met, no authentication or user interaction is needed. No EPSS score, no CISA KEV listing, and no confirmed public exploit were provided, so there is no evidence of active or widespread exploitation - the exploitation status is 'no public exploit identified at time of analysis.' SSVC-style reasoning: technical impact is total (traffic interception plus tampering via a MITM proxy with certificate validation disabled), but the attack is NOT automatable because it is gated on chaining a separate Discord XSS and typically a client restart to apply the injected Chromium switches. Net assessment: a genuinely high-impact confidentiality/integrity flaw, but practical likelihood is moderated by the XSS prerequisite and the product's niche footprint, placing it below drop-everything emergencies absent a known Discord XSS chain.

An attacker first obtains script execution inside the Discord page rendered by Legcord (e.g., via a Discord XSS in a message, embed, or profile field). From that context they call window.legcord.settings.setConfig to append --proxy-server and --ignore-certificate-errors to additionalArguments; after the client relaunches, all of the victim's client traffic is silently routed through the attacker's intercepting proxy with TLS validation disabled. No public exploit was identified in the provided data, though VulnCheck has published an advisory and the vendor GitHub issue documents the mechanism.