Logseq CVE-2026-47899

The attacker must first obtain JavaScript execution inside the Logseq renderer process - concretely, by getting the victim to render attacker-controlled content that triggers an XSS in Logseq's note renderer, or by convincing the victim to install a malicious Logseq plugin. Once that foothold exists no further authentication, privilege, or user interaction is required to invoke the exposed preload IPC method and perform arbitrary filesystem operations. Exploitation is limited to the desktop Electron build (not the mobile or web variants), is bounded by the privileges of the OS user running Logseq, and was empirically validated only against version 0.10.15.

The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:N/UI:N, VC:H/VI:H/VA:N, SC:H/SI:H) scores 8.7 and accurately reflects the threat model: the attacker does not need credentials or user interaction, but they do need a foothold in the renderer (AT:P denotes the required attack precondition), typically a stored XSS in note content, a markdown-rendering bug, or a malicious community plugin. Because Logseq notes are frequently imported from external sources and the plugin ecosystem is third-party, that precondition is realistic rather than exotic. The high subsequent-system scores (SC:H/SI:H) correctly capture that the renderer compromise pivots to the host filesystem and therefore to credentials, SSH keys, browser data, and ultimately code execution via overwritten dotfiles. EPSS and KEV signals are absent from the input - no confirmed active exploitation and no published exploit - so this is a high-severity but not yet widely weaponised issue. The chief uncertainty is the version range: only 0.10.15 was tested, and the vendor has not shipped a fix, so defenders should treat all currently installed versions as potentially affected pending vendor confirmation.

An attacker authors a markdown note, plugin, or shared graph containing a payload that triggers JavaScript execution in the Logseq renderer when the victim opens it; the payload then calls the unvalidated preload IPC method to overwrite ~/.bashrc, ~/.ssh/authorized_keys, or a Logseq config file with attacker-controlled content. On the next shell launch or SSH login the planted content executes, yielding persistent code execution as the user. No public exploit identified at time of analysis, but the bug class is straightforward to weaponise given the documented preload behaviour.