CVE-2026-47899
Arbitrary File Read, Write, Rename, and Delete in Logseq
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Electron preload script in Logseq exposes an API method that allows the renderer process to invoke IPC handlers without proper path validation. An attacker with JavaScript execution in the renderer (e.g. via XSS or a malicious plugin), can read, write, or delete arbitrary files on the user's system. While only version v0.10.15 was tested and confirmed as vulnerable, status of other versions is unknown since this issue was not addressed by a patch.
| CWE | CWE-749 |
| Vendor | logseq |
| Product | logseq |
| Published | Jun 9, 2026 |
| Last Updated | Jun 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for logseq logseq
Be the first to know when new unknown vulnerabilities affecting logseq logseq are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
logseq / logseq
0 ≤ 0.10.15
References
Credits
Bartłomiej Dmitruk (striga.ai)