CVE-2026-105293

Name of the Vulnerable Software and Affected Versions Legcord versions 1.1.0 through 1.3.0

Description Path traversal exists in theme IPC handlers, allowing scripts running in the Discord origin, such as through Cross-Site Scripting (XSS), to escape the themes directory. This occurs due to unvalidated theme IDs. Attackers can abuse the themes.folder, themes.uninstall, and themes.install handlers to launch local executables, recursively delete directories, and write files outside the intended themes directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.