PT-2026-47800 · Logseq · Logseq

Bartłomiej Dmitruk · CVE-2026-47901 · Published 2026-06-09 · Updated 2026-06-09

Positive Technologies (AI Summary)

CVSS v4.0

4.6

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Logseq version 0.10.15

Description A sandbox escape flaw allows plugins running in sandboxed iframes to inject arbitrary HTML attributes, such as event handlers, into their container element in the host DOM. Because the Content Security Policy (CSP)—a security layer that helps detect and mitigate certain types of attacks—is disabled, a malicious plugin can execute arbitrary JavaScript within the privileged host context. This may lead to unauthorized access to filesystem APIs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-47901

Affected Products

Logseq

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-47901 · Security Note
• https://cert.pl/en/posts/2026/06/CVE-2026-9279 · Note
• https://twitter.com/f1tym1/status/2064346639087653096 · Twitter Post
• https://logseq.com · Note