Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: logseq Clear all filters
TI-2026-35349 CVE-2026-47901 · GHSA-jm26-ghmc-7c2w

Iframe escape by plugins in Logseq

Priority LOW 20

Logseq is vulnerable to a sandbox escape flaw where plugins running in sandboxed iframes can inject arbitrary HTML attributes, such as event handlers, into their container element in the host DOM.

CVSS 4.0MEDIUM 4.6 Local No auth User interaction EPSS 0.00139 Published 2026-06-09 No fix listed CWE-79
TI-2026-35347 CVE-2026-47899 · GHSA-jq3m-h4m5-r9j5

Arbitrary File Read, Write, Rename, and Delete in Logseq

Priority LOW 39

The Electron preload script in Logseq exposes an API method that allows the renderer process to invoke IPC handlers without proper path validation.

CVSS 4.0HIGH 8.7 Local No auth No interaction EPSS 0.00137 Published 2026-06-09 No fix listed CWE-749
TI-2026-08151 CVE-2026-9279 · GHSA-c3m5-8vv9-gg8p

Shell command injection in Logseq

Priority MEDIUM 45

Logseq exposes an IPC handler that allows the renderer process to execute shell commands.

CVSS 4.0HIGH 8.7 Local No auth No interaction EPSS 0.0027 Published 2026-06-09 No fix listed CWE-78