Sandbox Escape Vulnerability in Logseq by Logseq Inc.
CVE-2026-47901

4.6MEDIUM

Key Information:

Vendor

Logseq

Status
Logseq
Vendor
CVE Published:
9 June 2026

What is CVE-2026-47901?

Logseq is affected by a critical sandbox escape vulnerability that permits plugins running in sandboxed iframes to inject arbitrary HTML attributes into the host DOM. This flaw arises from a disabled Content Security Policy (CSP), enabling a malicious plugin to execute arbitrary JavaScript within the trusted host environment. Consequently, this could lead to unauthorized access to sensitive filesystem APIs. Although only version v0.10.15 has been tested and confirmed as vulnerable, the status of other versions remains unverified and unpatched.

Affected Version(s)

logseq 0 <= 0.10.15

References

https://cert.pl/en/posts/2026/06/CVE-2026-9279/
third-party-advisory
https://logseq.com/
product

CVSS V4

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bartłomiej Dmitruk (striga.ai)
.