CVE-2026-74234

Name of the Vulnerable Software and Affected Versions Legora versions prior to 2026-08-14

Description A cross-site scripting issue exists where attackers can execute arbitrary JavaScript in a victim's browser. This occurs when a Mermaid block is prefixed with a gray-matter JavaScript front-matter directive, leading the front-matter parser to invoke the eval() function before SVG sanitization takes place. The flaw is exploitable via manipulated Mermaid diagram content. The impact is increased on Word and Outlook add-in surfaces because bearer session tokens are stored in localStorage.

Recommendations Update Legora to a version released on or after 2026-08-14.