PT-2026-47799 · Logseq · Logseq

Bartłomiej Dmitruk · CVE-2026-47900 · Published 2026-06-09 · Updated 2026-06-09

Positive Technologies (AI Summary)

CVSS v4.0

4.6

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Logseq version 0.10.15

Description A stored cross-site scripting (XSS) issue exists where a malicious plugin can include a JavaScript payload in the name field of its package.json file. This occurs because the field is rendered using innerHTML without proper sanitization, enabling the execution of arbitrary code within the privileged host context.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-47900

Affected Products

Logseq

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-47900 · Security Note
• https://logseq.com · Note
• https://twitter.com/VulmonFeeds/status/2064377241518113101 · Twitter Post
• https://cert.pl/en/posts/2026/06/CVE-2026-9279 · Note