PT-2026-47804 · Logseq · Logseq

Bartłomiej Dmitruk · Published 2026-06-09 · Updated 2026-06-09 · CVE-2026-9279

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions Logseq version 0.10.15

Description An OS command injection flaw exists in the IPC handler, which allows the renderer process to execute shell commands. Although an allowlist restricts command names to specific tools such as git, pandoc, and grep, the argument string is concatenated with the command and passed to the child process.spawn() function with the shell: true option. This configuration allows shell metacharacters within the arguments to bypass the allowlist. An attacker capable of executing JavaScript in the renderer, such as through Cross-Site Scripting (XSS) in note content or a malicious plugin, can execute arbitrary shell commands with the privileges of the Logseq process, resulting in remote code execution on the host.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-9279

Affected Products

Logseq

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-9279 · Security Note
• https://twitter.com/f1tym1/status/2064346639087653096 · Twitter Post
• https://twitter.com/UpwindMDR/status/2064357472484143570 · Twitter Post
• https://logseq.com · Note
• https://cert.pl/en/posts/2026/06/CVE-2026-9279 · Note