A high-severity cross-site scripting vulnerability in Legora allows attackers to execute arbitrary JavaScript in a victim's browser, potentially leading to session hijacking or data theft.

The vulnerability is an eval injection flaw where the front-matter parser incorrectly processes Mermaid blocks. An attacker can embed a crafted directive that invokes eval() before the application performs necessary SVG sanitization, leading to cross-site scripting.

A CVSS score of 7.7 highlights the significant risk of arbitrary JavaScript execution. Successful exploitation could allow an attacker to compromise user sessions, steal cookies, or perform actions on behalf of the user within the Legora application, leading to unauthorized data access.

Immediate Action: Update the Legora installation to the version released on 2026-08-14 or later to ensure the front-matter parser is patched.

Proactive Monitoring: Monitor web application logs for suspicious input patterns, specifically focusing on Mermaid block syntax or unexpected characters in front-matter fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block malicious JavaScript injection patterns and unusual front-matter directives.

Public Exploit Available: Unknown

Organizations using Legora should treat this vulnerability with high urgency. Applying the vendor-provided update is the only reliable way to neutralize the eval injection risk and prevent potential browser-based attacks against users.