Legcord: Configuration injection via settings bridge enables proxy routing

Summary

Legcord 1.1.0 through 1.3.0, an unofficial third-party Discord client, lets script running on the Discord page write any configuration key through its settings bridge. An attacker who already has script execution on that page, for example through a cross-site scripting flaw, can persistently add Chromium switches that route all client traffic through an interception proxy and disable certificate error checks. Exploitation requires that prior script-injection foothold, so the risk is mainly on endpoints where the client is installed.

Affected

• Legcord 1.1.0 through 1.3.0

Fixed in

• Legcord 1.3.1, according to the vendor release notes, which also cover CVE-2026-105293
• The OSV record lists 1.3.0 as fixed, which conflicts with the vendor release notes and is treated as a data error

Workaround

• No vendor workaround beyond upgrading is known.
• After upgrading, check the settings file for unexpected entries in additionalArguments, such as --proxy-server or --ignore-certificate-errors. On Linux the file is typically ~/.config/legcord/storage/settings.json.

Exploitation

• No public exploit found. Not marked as known exploited. CISA SSVC: exploitation none, automatable no.
• An unconfirmed incident report (GitHub issue 1174) links an account compromise to this CVE. The maintainer disputes the link.

Our recommendation

• Inventory Legcord installations on company devices, including unapproved (shadow IT) installations.
• Upgrade to Legcord 1.3.1 or later and patch CVE-2026-105293 at the same time.
• Check the configuration for leftover proxy or certificate flags.
• Require the official Discord app or web client on work devices, or block unofficial clients by policy.
• Monitor for unexpected proxy traffic and unusual account activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Legcord CVE record advisory (VulnCheck) www.vulncheck.com
• Legcord project repository github.com
• Legcord ipc.ts at v1.3.0 (vulnerable code) github.com
• Legcord issue 1163 github.com
• Legcord issue 1174 (incident report, disputed) github.com
• Legcord releases github.com
• OSV entry CVE-2026-105294 osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:32.