Legcord Path Traversal and Config Injection

Path traversal in Legcord's theme IPC handlers (versions 1.1.0 through 1.3.0) allows an attacker who already has script execution inside the embedded Discord page - for example via XSS - to supply unvalidated theme ids to themes.folder, themes.uninstall, and themes.install and escape the themes directory. That yields arbitrary file writes, recursive directory deletion, and local executable launch, i.e. host code execution; CVSS 4.0 scores it 9.2 (Critical) with full confidentiality, integrity, and availability impact, and PR:N means no further authentication is required once the script foothold exists, while AC:H and AT:P capture that prerequisite. No public exploit code was identified at time of analysis and no CISA KEV listing is present.

Configuration injection in the Legcord Electron Discord client 1.1.0 through 1.3.0 lets JavaScript executing inside the loaded Discord page write arbitrary configuration keys through the exposed window.legcord settings.setConfig bridge, and the practical payload is the additionalArguments key - persistently adding the Chromium switches --proxy-server and --ignore-certificate-errors so that all client traffic is routed through an attacker-controlled interception proxy with TLS validation disabled. The flaw carries a Critical CVSS 4.0 score of 9.1, but exploitation is not self-contained: it is gated on a pre-existing, independent cross-site scripting flaw in the Discord web content the client renders (Attack Requirements: Present / AC:H), making it an impact-amplification and privilege-escalation primitive rather than a standalone remote compromise, and the attacker's writes are launch-time arguments that generally need a client restart before the proxy and certificate bypass take effect. There is no public exploit code identified at time of analysis and no CISA KEV listing, so the realistic risk is concentrated in users running the affected Legcord builds who are also exposed to a workable Discord-side XSS.