Legora
Monthly
Cross-site scripting in Legora before 2026-08-14 allows attackers with content-submission access to execute arbitrary JavaScript in victims' browsers by exploiting an eval() call in the gray-matter JavaScript front-matter parser, which fires before Mermaid SVG sanitization runs. The impact is materially elevated on Word and Outlook add-in surfaces where bearer session tokens are persisted in localStorage, enabling session hijacking beyond the browser context. No public exploit code or active exploitation (CISA KEV) has been identified, though the CVSS 4.0 subsequent-system scores of SC:H and SI:H reflect real-world session-token theft risk in add-in deployments.
Cross-site scripting in Legora before 2026-08-14 allows attackers with content-submission access to execute arbitrary JavaScript in victims' browsers by exploiting an eval() call in the gray-matter JavaScript front-matter parser, which fires before Mermaid SVG sanitization runs. The impact is materially elevated on Word and Outlook add-in surfaces where bearer session tokens are persisted in localStorage, enabling session hijacking beyond the browser context. No public exploit code or active exploitation (CISA KEV) has been identified, though the CVSS 4.0 subsequent-system scores of SC:H and SI:H reflect real-world session-token theft risk in add-in deployments.