- Community aggregator
- Country: United States
Legcord (Discord Client) — 2 CVEs: XSS in Discord Page Becomes RCE + Persistent Traffic Interception
If you use Legcord as your Discord client, a script running in the Discord page can break out of the Electron sandbox entirely. CVE-2026-105293 (CVSS 8.1) — Path Traversal to RCE Theme IPC handlers (themes.install, themes.uninstall, themes.folder) accept identifiers without sanitizing ../…