THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-74234 (HIGH 7.7) — Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser

[NVD] CVE-2026-74234 (HIGH 7.7) — Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser

mednvdPublished 2026-08-17

CVE-2026-74234 CVSS: 7.7 HIGH Published: 2026-08-17T20:16:46.813

Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval() before any SVG sanitization occurs.

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-74234cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-74234