CVE-2026-74234: Legora < 2026-08-14 XSS via Mermaid gray-matter JavaScript Engine
Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval() before any SVG sanitization occurs. Attackers can exploit this flaw through influenced Mermaid diagram content to execute arbitrary JavaScript in the user's browser context, with elevated impact on Word and Outlook add-in surfaces where bearer session tokens are persisted in localStorage.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Legorato a version that resolves this vulnerability.Fixed in 2026-08-14 - Configuration
Reduce impact in add-in surfaces by ensuring bearer session tokens are not persisted in localStorage (since elevated impact occurs where tokens are stored there).
Word add-in / Outlook add-in (bearer session token storage) localStorage persistence of bearer session tokens = remove/disable persistence in localStorage - Compensating control
Mitigate exposure by preventing untrusted users or content from influencing rendered Mermaid diagram content (especially Mermaid blocks with gray-matter JavaScript front-matter directives that could trigger eval() before SVG sanitization).
- Operational
After upgrading, rotate any bearer/session tokens potentially exposed via localStorage to invalidate attacker access.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74234?
CVE-2026-74234 has a severity rating of high, with a score of 7.7.
How do I fix CVE-2026-74234?
To mitigate CVE-2026-74234, upgrade Legora to version 2026-08-14 or later.
What type of vulnerability is CVE-2026-74234?
CVE-2026-74234 is a cross-site scripting (XSS) vulnerability.
What impact does CVE-2026-74234 have on users?
CVE-2026-74234 allows attackers to execute arbitrary JavaScript in a victim's browser.
Which software is affected by CVE-2026-74234?
CVE-2026-74234 affects Legora versions prior to 2026-08-14.