Which versions of Logseq are affected by CVE-2026-9279?

Logseq desktop application (versions v0.10.15 and later) contains a critical remote code execution vulnerability allowing attackers to execute arbitrary OS commands at the Logseq process privilege…

How to fix or mitigate CVE-2026-9279?

Within 24 hours: Identify all Logseq installations (v0.10.15 and later) across the organization through asset inventory and endpoint tools. Within 7 days: Implement interim controls-restrict plugin installations to official Logseq repositories, disable untrusted plugin sources, enforce Content Security Policy if applicable, and apply application-level sandboxing where available; document exceptions and elevated risk. Within 30 days: Establish vendor monitoring for patch availability; evaluate alternative note-taking applications (Obsidian, Notion, Joplin with plugin restrictions) as potential replacements; maintain air-gapped or offline Logseq usage for sensitive documents until patch release.

Logseq CVE-2026-9279

Q: What is the CVSS score of CVE-2026-9279?

CVE-2026-9279 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-35435 HIGH

OS Command Injection (CWE-78)

2026-06-09 CERT-PL

GHSA-c3m5-8vv9-gg8p

XSS RCE Command Injection Logseq

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 14:30 vuln.today

CVSS changed

Jun 09, 2026 - 14:22 NVD

8.7 (HIGH)

DescriptionCVE.org

Logseq exposes an IPC handler that allows the renderer process to execute shell commands. While an allowlist restricts the command name (e.g. git, pandoc, grep), the argument string is concatenated with the command and passed to child_process.spawn with the shell: true option, allowing shell metacharacters in the arguments to bypass the allowlist. An attacker with JavaScript execution in the renderer (e.g. via XSS or a malicious plugin) can execute arbitrary shell commands with the privileges of the Logseq process, leading to remote code execution on the host. While only version v0.10.15 was tested and confirmed as vulnerable, status of other versions is unknown since this issue was not addressed by a patch.

AnalysisAI

Command injection in Logseq desktop application enables remote code execution via shell metacharacter abuse in IPC-exposed command arguments. An attacker with JavaScript execution in the renderer process (through XSS or a malicious plugin) can bypass the command allowlist because arguments are concatenated and passed to child_process.spawn with shell:true, granting arbitrary OS command execution at the privileges of the Logseq process. No public exploit identified at time of analysis, but the issue was reported by CERT-PL and remains unpatched in versions beyond the tested v0.10.15.