CVE-2026-105294 | CVSS: 7.4 | 严重级别: HIGH
Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.setConfig bridge. Attackers exploiting a Discord XSS can set additionalArguments to persistently add –proxy-server and –ignore-certificate-errors switches, routing all client traffic through an interception proxy.
参考链接:
• https://github.com/Legcord/Legcord
• https://github.com/Legcord/Legcord/blob/v1.3.0/src/discord/ipc.ts#L296-L299
• https://github.com/Legcord/Legcord/blob/v1.3.0/src/main.ts#L277-L307
📌 数据来源: NVD 官方
⚠️ 合规声明: 本文内容仅用于网络安全合规学习、科研与授权测试用途。严禁用于任何未授权行为,违者自行承担全部法律责任。