Remote Code Execution Vulnerability in Logseq by Logseq

CVE-2026-9279

What is CVE-2026-9279?

Logseq has a vulnerability wherein its IPC handler permits the execution of shell commands from the renderer process. Although there is an allowlist that limits the command names (such as 'git', 'pandoc', 'grep'), the concatenation of the argument string with the command and its passing to 'child_process.spawn' using the 'shell: true' option means that shell metacharacters can be exploited. This creates a loophole that an attacker can leverage if they possess JavaScript execution capabilities in the renderer, such as through cross-site scripting (XSS) or a malicious plugin. Consequently, this vulnerability can lead to the execution of arbitrary shell commands with the privileges associated with the Logseq process, which poses a significant risk of remote code execution on the affected host system. While only version v0.10.15 has been explicitly confirmed vulnerable, the status of other versions remains uncertain as this issue lacks a patch.

References