CVE-2026-74234 Overview
CVE-2026-74234 is a cross-site scripting (XSS) vulnerability in Legora versions before 2026-08-14. The flaw allows attackers to execute arbitrary JavaScript in a victim's browser by embedding a Mermaid diagram block prefixed with a gray-matter JavaScript front-matter directive. The front-matter parser invokes eval() on attacker-controlled content before any SVG sanitization runs. The issue is classified under CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code, or Eval Injection). Impact is elevated on the Word and Outlook add-in surfaces, where bearer session tokens are persisted in localStorage and become accessible to injected script.
Critical Impact
Attackers who influence Mermaid diagram content can execute JavaScript in the victim's session and exfiltrate bearer tokens stored in localStorage on Word and Outlook add-in surfaces.
Affected Products
- Legora versions released before 2026-08-14
- Legora Word add-in surface
- Legora Outlook add-in surface
Discovery Timeline
- 2026-08-17 - CVE-2026-74234 published to NVD
- 2026-08-21 - Last updated in NVD database
Technical Details for CVE-2026-74234
Vulnerability Analysis
The vulnerability sits at the intersection of two libraries commonly used in Markdown rendering pipelines: gray-matter for front-matter parsing and Mermaid for diagram rendering. Legora renders Mermaid blocks that first pass through a front-matter parser configured with the JavaScript engine enabled. When the parser encounters a JavaScript front-matter directive, it invokes eval() on the directive body. Attackers control this body through influenced Mermaid diagram content.
Because eval() executes before Mermaid produces SVG output, the downstream SVG sanitizer never sees the malicious payload. The sanitizer only inspects rendered SVG markup, not code paths that ran during parsing. The result is arbitrary JavaScript execution in the origin of the Legora application.
On Word and Outlook add-in surfaces, Legora persists bearer session tokens in localStorage. Injected script running in the add-in's origin can read those tokens and forward them to attacker-controlled infrastructure, enabling session hijacking against the Legora backend.
Root Cause
The root cause is unsafe evaluation of untrusted input by the gray-matter front-matter parser with the JavaScript engine enabled. The Mermaid rendering pipeline delegates front-matter handling before applying content sanitization, violating the principle that untrusted content must never reach an evaluation sink.
Attack Vector
An attacker supplies a Mermaid block containing a gray-matter JavaScript front-matter header. When a victim renders a document that contains this block, Legora's parser evaluates the attacker's JavaScript in the browser. Exploitation requires user interaction and some conditions attackers cannot fully control, which is reflected in the assigned severity. See the VulnCheck Advisory #2026-08-14 for the full technical write-up.
No verified proof-of-concept code is available at time of publication. The vulnerability mechanism is documented in prose in the referenced advisory.
Detection Methods for CVE-2026-74234
Indicators of Compromise
- Mermaid code blocks containing gray-matter front-matter delimiters (---) followed by a JavaScript engine directive
- Outbound requests from Legora client sessions to unfamiliar domains carrying bearer tokens or localStorage contents
- Unexpected reads of localStorage session keys within Word or Outlook add-in surfaces
Detection Strategies
- Inspect stored Mermaid content in Legora documents for front-matter blocks that declare a JavaScript engine
- Deploy Content Security Policy (CSP) reporting to surface unsafe-eval executions or unexpected script origins in the add-in context
- Correlate authentication events for anomalous reuse of bearer tokens from new IPs or user agents
Monitoring Recommendations
- Log and alert on document ingestion where Mermaid blocks contain gray-matter fences with executable directives
- Monitor Legora add-in telemetry for network egress to non-allowlisted destinations following diagram rendering
- Track version compliance so all Legora clients run builds dated 2026-08-14 or later
How to Mitigate CVE-2026-74234
Immediate Actions Required
- Upgrade all Legora deployments and add-ins to the release dated 2026-08-14 or later
- Invalidate active bearer session tokens issued to Word and Outlook add-in users before the patch date
- Audit shared documents for Mermaid blocks containing gray-matter JavaScript directives and quarantine affected content
Patch Information
Legora addressed CVE-2026-74234 in the release dated 2026-08-14. Refer to the Legora Security Solutions site and the VulnCheck Advisory #2026-08-14 for the vendor advisory and remediation details.
Workarounds
- Disable the JavaScript engine option on the gray-matter parser used by the Mermaid rendering pipeline
- Migrate bearer session tokens off localStorage to HttpOnly cookies to reduce token exposure to XSS
- Apply a strict Content Security Policy that forbids unsafe-eval in the add-in origins until the patch is deployed
# Example CSP header to block eval-based XSS pending patch deployment
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'none'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
