Description

Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval() before any SVG sanitization occurs. Attackers can exploit this flaw through influenced Mermaid diagram content to execute arbitrary JavaScript in the user's browser context, with elevated impact on Word and Outlook add-in surfaces where bearer session tokens are persisted in localStorage.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-17T20:16:46.813Z",
  "pubdate": "2026-08-17T20:16:46.813Z",
  "executiveSummary": "Legora before 2026-08-14 suffers from a cross-site scripting (XSS) vulnerability stemming from improper input handling within Mermaid block processing. The flaw allows remote attackers to execute arbitrary JavaScript within a victim's browser context. The vulnerability impacts systems utilizing the Legora product, presenting severe risk implications particularly within enterprise environments. Specifically, the execution context elevates impact on Word and Outlook add-in surfaces where sensitive authentication artifacts, such as bearer session tokens, are persistently stored in localStorage. Attackers can successfully exploit this vulnerability by injecting crafted Mermaid diagram content containing malicious directives. Successful exploitation requires the rendering of the influenced Mermaid block containing the payload, subsequently triggering arbitrary script execution in the user session without requiring prior authentication to the underlying vulnerable component.",
  "technicalDetails": "The vulnerability resides in the front-matter parser utilized during the processing of Mermaid blocks within Legora before 2026-08-14. The root cause is the insecure execution flow where a gray-matter JavaScript front-matter directive prefixed to a Mermaid block causes the front-matter parser to invoke the native JavaScript eval() function. This dangerous evaluation occurs prematurely, executing prior to any SVG sanitization routines designed to neutralize malicious input. The vulnerable component is the markdown and diagram parsing engine responsible for handling embedded Mermaid diagrams. Attackers exploit this flaw by supplying influenced Mermaid diagram content engineered with a malicious JavaScript front-matter directive. The step-by-step attack flow begins when an unsuspecting user loads or views content containing the crafted Mermaid block. Upon processing, the Legora parsing engine encounters the front-matter directive and invokes eval() to interpret the prefixed content. This execution bypasses all downstream SVG sanitization mechanisms because the malicious script runs during the parsing phase rather than the rendering phase. Once evaluated, the payload executes arbitrary JavaScript in the user's browser context. The post-exploitation impact is significantly elevated when this occurs within Word and Outlook add-in surfaces. In these specific contexts, session persistence mechanisms maintain bearer session tokens directly in localStorage. Consequently, the executed JavaScript can access localStorage, harvest sensitive bearer tokens, and compromise the user session or connected enterprise services."
}