CVE-2026-74234

Legora versions prior to August 14, 2026, are vulnerable to a cross-site scripting (XSS) flaw that enables attackers to execute arbitrary JavaScript in users' browsers by manipulating Mermaid diagram content. This vulnerability poses a significant risk, particularly for users of Word and Outlook add-ins, as it can lead to unauthorized access to sensitive session tokens stored in localStorage. Organizations utilizing Legora should prioritize patching this vulnerability to mitigate potential exploitation.