This is CVE-2026-74234 — a pipeline sequencing vulnerability where Legora's front-matter parser executes eval() before the SVG sanitizer runs. That's the critical distinction: the eval() isn't triggered by user-supplied Mermaid content reaching a vulnerable sink directly. It's the gray-matter parser itself — processing what should be inert front-matter metadata — that invokes eval() before downstream sanitization can intervene. The attack surface isn't 'unsanitized user input.' It's a specific sequencing failure: front-matter directives are interpreted and executed as JavaScript, and only after that does SVG sanitization occur. An attacker doesn't need a sanitizer bypass; they need content the parser interprets as code before sanitization touches it.
The Office add-in context compounds this significantly. Bearer session tokens persisted in localStorage transform a standard injection into a token theft vector with persistence inside Microsoft Word and Outlook. The Mermaid rendering surface becomes an authenticated attack surface, not an anonymous one. The exploit path chains the eval() trigger with existing token storage practices that may not have been flagged as risky.
Audit your Legora deployment: determine whether gray-matter's eval() capability is being invoked intentionally (legitimate for developer-owned templates) or whether the parser is receiving content it should reject as malformed front-matter. Review the token persistence model on Office surfaces — if tokens are in localStorage, the XSS payload has access to authentication state that httpOnly cookies would have protected. Deploy the patch from August 14, 2026, and extend detection coverage to front-matter parsing, not just content-level injection. This vulnerability class sits earlier in its exploitation lifecycle than established SSTI variants — detection signatures and institutional memory haven't caught up yet, so assume a longer remediation window than the CVSS score suggests.