File Manipulation Vulnerability in Logseq by Electron Preload Script

CVE-2026-47899

What is CVE-2026-47899?

The Electron preload script in the Logseq application introduces a severe flaw by permitting an API method that enables the renderer process to invoke Inter-Process Communication (IPC) handlers without adequate path validation. This vulnerability can be exploited by attackers who manage to execute JavaScript within the renderer, which could occur through avenues like Cross-Site Scripting (XSS) or malicious plugins. As a result, attackers can potentially read, write, or delete arbitrary files from the user's system. While the specific version v0.10.15 has been confirmed as vulnerable, the security status of other versions remains undetermined, as no patch has been issued to rectify the issue.

References