Patryk Żurek

Hey all ;)

It's been 3 months since the last Legcord update, and some people have started to wonder if the project is dead. I want to assure you that it's not, however it needs a lot of work to get it back on track. I have been working on Legcord in my free time for the past 6 years now, and it's been 4 years since the last major rewrite (CertainArchitectureCord 3.x.x). It has achieved a lot of success, has been covered by few news outlets and YouTubers. When I created this project I never expected it to grow out of my own bubble of friends. Over the last year, I've grown a lot of hatred towards the current codebase, and I have been thinking about rewriting it from scratch for a while now. I have finally decided to do it, and I will be starting the rewrite soon. But before we get into that, I want to talk about the CVE-2026-105294

First ever (?) security vulnerability in Legcord

Recently, a GitHub issue was opened regarding CVE-2026-105294. A user claimed their account was compromised and started sending a "MrBeast" scam to their friends list shortly after installing Legcord.

Let's look at what this CVE actually is. The advisory states that Legcord versions 1.1.0 through 1.3.0 contained a configuration injection vulnerability. In technical terms, it allowed a script running inside the Discord page to write to any config key using our window.legcord settings.setConfig bridge (which is intended design, but more on that later). If an attacker exploited this, they could persistently inject command-line arguments like --proxy-server and --ignore-certificate-errors. This would route all your client traffic through an interception proxy, allowing them to steal your session token.

There is an important distinction to make here: this vulnerability does not, by itself, provide an attacker with a way to execute arbitrary scripts inside your client. It requires a separate way to run malicious JavaScript in the first place.

However, that doesn't make the vulnerability harmless. It introduces additional ways to tamper with the client's configuration and potentially persist malicious changes. A vulnerability can significantly increase the impact of an existing compromise without being a standalone entry point.

Please remember that current Legcord architecture is not designed to be secure against malicious scripts (and it possibly never will be - at least with the current set of functionality). Legcord prioritizes user freedom and ability to tinker with the client, and this comes at the cost of security. The responsiblity sadly falls on the end user. We provide powerful tools/APIs that can produce powerful and useful plugins if used responsibly. However they can be misused if not used carefully.

I'll be working on spreading more social awareness and adding educational warnings to the Legcord client to help users understand the risks of installing untrusted plugins. But at the end of the day, if you want a secure Discord client, I recommend using a unmodified version of the official Discord desktop client.

The security vulnerability has been fixed in Legcord 1.3.1, which is now available for download.

A second vulnerability: theme IPC path traversal

There is another vulnerability worth discussing here: CVE-2026-105293, which affects Legcord versions 1.1.0 through 1.3.0.

This one is a little different from the configuration injection vulnerability described above. It affects the IPC handlers responsible for managing themes. These handlers did not properly validate theme IDs, which could allow a malicious script running inside the Discord page to access paths outside the intended themes directory.

Depending on the operation, this could allow an attacker to write files outside the themes directory, delete directories recursively, or even launch local executables.

As with the previous vulnerability, exploiting it requires a way to execute malicious JavaScript in the Discord page in the first place. There's a high chance you're not affected by this vulnerability if you haven't installed any untrusted themes or plugins.

Both of these vulnerabilities affect Legcord versions up to 1.3.0. Please make sure you're running Legcord 1.3.1 or newer, and avoid installing plugins or even themes from sources you don't trust. You can read more about the technical details in the VulnCheck advisory.

What should you do?

Both vulnerabilities affect Legcord versions 1.1.0 through 1.3.0. Please update to Legcord 1.3.1 or newer, where these issues have been addressed.

I haven't seen any reports of these vulnerabilities being exploited in the wild, but it's always better to be safe than sorry.

I recommend reviewing your installed plugins and themes and removing anything you don't recognize or trust (this is a good practice, not just for security reasons - performance too). If you've pasted suspicious code into the developer console or suspect that you've installed something malicious, you should take that seriously.

If you believe your Discord account has been compromised, follow Discord's official account recovery and security procedures. Updating Legcord alone cannot undo a compromise that has already occurred.

If you want to start with a clean Legcord configuration, you can back up anything important and then delete the configuration directory:

Linux: ~/.config/Legcord

Windows: %APPDATA%\Legcord

This will remove your local Legcord data, including settings and plugins. Depending on your installation and platform, configuration paths may differ.

Legcord 2: Electric Boogaloo

Modules. Modules... Modules everywhere!

I have been thinking about the future of Legcord for a while now, and I have decided that the current architecture is not sustainable. The current codebase is a MESS, and it's hard to maintain and add new features. The technical debt and the design decisions I made when I was 15 are now coming back to haunt me. The new architecture will be based on a modular system, where each feature is a separate module. This will make it easier to maintain and add new features, as well as make it easier for users to customize their client. You'll be able to enable/disable modules as you wish, and even create your own modules if you want to.

This is very similar to how the official Discord client is structured.

pzurek@mini modules % ls
crashlogs		discord_dispatch	discord_intents		discord_notifications	discord_utils		discord_zstd
discord_cloudsync	discord_erlpack		discord_krisp		discord_rpc		discord_voice		installed.json
discord_desktop_core	discord_game_utils	discord_modules		discord_spellcheck	discord_webauthn	pending

With each module being a separate package, the official Discord client can update components independently. The new Legcord architecture will adopt this same approach, but take it a massive step further: we are opening it up to the community.

We will maintain a set of upstream core modules, and alongside them, provide powerful APIs that let anyone build their own. Whether it's a new client mod support (like BetterDiscord), a custom feature, or backporting functionality from other clients that don't share our OSL-3.0 license (like Vesktop), the possibilities are endless. These core modules will also be entirely replaceable so if you don't like how we implemented a feature, you can simply swap it out for your own.

By decentralizing the features, we're also tackling bloat. Legcord currently has one of the most overwhelming settings pages of any client. Moving forward, niche or unused features will become optional modules, resulting in a lighter, substantially faster core client.

This also completely changes how we handle updates. If a specific feature breaks (like themes), we will no longer have to push a fix to the dev branch and wait for a stable release. We can simply push an update to that individual module. To respect the boundaries of Linux package managers and repositories, we will still release time-frozen builds that don't automatically update core modules, and we'll publish detailed documentation on how that works closer to launch.

Themes will continue to work as they do now. They simply will be a module that can be enabled or disabled. So if you don't like native Legcord theming support, you can just disable the module and use your own.

Last, but certainly not least, there's security. While I am actively exploring module sandboxing to baby-proof the new architecture as much as possible, I can't make any concrete promises just yet. I'm very open to ideas and suggestions on how to make this as secure as possible, so if you have any, please reach out to me.

Now. The question is:

How long will this take?

I don't know. I have a lot of other things going on in my life (including some medical issues), and I don't want to rush this. I want to make sure that the new architecture is solid and well-designed, and that it will be easy to maintain and extend in the future. I'm refraining from using a lot of AI-assisted coding for this rewrite, as I want to make sure that the code is clean and maintainable and the developer experience is good. I will be working on this in my free time, and I will try to keep you updated on the progress. I'm also encouraging pre-existing/new contributors to help out outline the new architecture and help with the rewrite. If all of this sounds interesting to you, please reach out to me on Discord or GitHub. I would love to have your input and help.

In the meantime, Legcord 1.x will continue to receive security updates and bug fixes, but no new major features will be added. The current, half-baked plugin system will remain as it is, in its mostly broken state, until the new architecture is ready.

I know this isn't ideal, but I'd rather be honest about the state of the project than keep adding features to an architecture that needs a fundamental redesign.

So what's next?

Over the coming weeks, I plan to publish a new branch called rewrite, containing the new architecture and its accompanying design documents. I'll also publish a roadmap for Legcord 2.0 outlining the features and modules we plan to implement.

The first steps will be to establish a core architecture then document the module APIs, and gather feedback from the community before committing too heavily to implementation details. From there, we'll work towards a maintainable foundation that contributors can build on.

Keep an eye on the Discord server for updates, and feel free to join the discussion if you'd like to help shape the future of Legcord.

Thank you for reading this and sticking with Legcord for the past six years. Whether you've contributed code, reported bugs, helped other users, or simply used the client, I really appreciate it.

<3

Patryk