Stored Cross-Site Scripting Vulnerability in Logseq by Logseq Inc.
CVE-2026-47900

4.6MEDIUM

Key Information:

Vendor

Logseq

Status
Logseq
Vendor
CVE Published:
9 June 2026

What is CVE-2026-47900?

Logseq is susceptible to stored cross-site scripting (XSS) attacks due to improper handling of JavaScript payloads in its plugin system. Specifically, a malicious plugin can exploit the vulnerability by injecting code via the 'name' field in its 'package.json' file. This payload is rendered using 'innerHTML' without adequate sanitization, permitting the execution of arbitrary scripts in a privileged context. Although tested versions have shown this vulnerability, the status of subsequent releases remains uncertain as no patch has currently been implemented.

Affected Version(s)

logseq 0 <= 0.10.15

References

https://cert.pl/en/posts/2026/06/CVE-2026-9279/
third-party-advisory
https://logseq.com/
product

CVSS V4

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bartłomiej Dmitruk (striga.ai)
.