CVE-2026-105293: Legcord Theme IPC Path Traversal

How to Detect It

Detection should focus on the precondition and consequences: unexpected script execution in the Discord renderer, unusual calls into theme functionality, writes outside the normal Legcord themes directory, recursive deletion, and child processes launched by Legcord. Endpoint telemetry is likely to be more useful than a network signature because the reported operations occur locally through Electron IPC.

The exact legitimate theme-directory path varies by operating system and installation method, and the supplied record does not define a universal path. Security teams should first identify the installation and profile paths used in their environment, then alert on Legcord-associated processes accessing unrelated user, system, startup, or application directories.

For suspected compromise on macOS, follow a structured collection process such as this digital forensics guide and preserve endpoint telemetry before removing the application.

Technical Notes

On Linux systems using auditd, administrators can monitor the Legcord executable after identifying its real path. The following example is a starting point and must be adapted to the local installation:

# Replace /opt/Legcord/legcord with the verified executable path.
sudo auditctl -w /opt/Legcord/legcord -p x -k legcord_exec

# Review Legcord execution and related audit activity.
sudo ausearch -k legcord_exec -i
sudo ausearch -ts today -i | grep -Ei 'legcord|themes|execve|unlink|rename|openat'

A useful behavioral query in an endpoint platform is to identify Legcord or its Electron child processes writing to locations outside the approved themes directory. Example pseudo-query logic is intentionally path-agnostic:

process.name in ("Legcord", "legcord", "electron")
and file.operation in ("create", "write", "rename", "delete")
and file.path not_under <approved_legcord_themes_directory>

Also alert when a Legcord process launches shells, scripting engines, installers, or unrelated native binaries. A child-process event such as Legcord -> cmd.exe, Legcord -> powershell.exe, Legcord -> bash, or Legcord -> sh is not proof of exploitation, but it is high-value triage evidence when paired with unexpected file activity.

Mitigation and Patching

There is no confirmed fixed version in the supplied primary-source research. The affected range remains 1.1.0 through 1.3.0, and upgrading to 1.3.0 does not resolve the issue. Administrators should monitor the Legcord repository, release notes, and advisory channels for a release that explicitly addresses validation in the theme IPC handlers.

Until a fix is confirmed, avoid using affected Legcord installations for sensitive accounts where practical. Restrict untrusted content and scripts from executing in the Discord origin, avoid loading untrusted themes, and consider removing Legcord from managed endpoints if the application is not essential. These controls reduce exposure but do not replace an upstream code fix.

If endpoint coverage is limited, organizations may evaluate a reputable malware scanner such as Get Bitdefender → as a supplementary check. Scanning does not patch the vulnerability and should not replace process, filesystem, and application telemetry.

If suspicious file writes, deletion, or process launches are confirmed, preserve evidence and follow your incident-response procedures. The first-hour ransomware response guide provides a useful framework for early containment and evidence preservation, even when ransomware has not been confirmed.

Technical Notes

A safe inventory check can identify installed Legcord versions without claiming that any version is patched:

# Linux example: inspect common package metadata and application paths.
find /opt "$HOME/.local" "$HOME/.config" -maxdepth 4 \
  \( -iname '*legcord*' -o -iname 'package.json' \) 2>/dev/null

# If a Legcord package directory is found, inspect its version.
grep -R '"version"' /path/to/legcord/package.json 2>/dev/null

Do not use a blind upgrade command that installs 1.3.0 and reports success as remediation. For temporary containment, stop the application and remove or quarantine it using the endpoint’s normal software-management process. On a Linux host where Legcord is running as a user process, an administrator can use:

pkill -f '[Ll]egcord'

If the application provides a supported theme-disable setting, disable theme installation, import, and management until a verified fix is available. Do not manually delete arbitrary directories as a workaround; the vulnerability’s reported impact includes recursive deletion, so containment changes should be controlled, logged, and tested.

References

The primary vulnerability record is the NVD API entry for CVE-2026-105293:

• NVD CVE-2026-105293 record
• Legcord repository
• Referenced theme source in v1.3.0
• Referenced IPC source in v1.3.0

Additional project and advisory material includes the public security report and the project’s download page. These sources should be rechecked before publication or remediation decisions because release and patch status can change after the CVE’s initial publication:

• Legcord security issue #1163
• VulnCheck advisory
• Legcord downloads

Start by identifying every Legcord installation in the affected range and contain systems where script can execute in the Discord origin. Until an upstream release explicitly fixes the theme IPC validation, use endpoint telemetry to catch writes, deletions, and child-process launches that fall outside normal Legcord behavior.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.