CVE-2026-47900

UNKNOWN 0.0

Stored XSS via Unsanitized Plugin Metadata in Logseq

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Logseq is vulnerable to a stored cross-site scripting (XSS). A malicious plugin can include a JavaScript payload in the "name" field of its "package.json" file, which is rendered using "innerHTML" without proper sanitization, allowing the execution of arbitrary code in the privileged host context. While only version v0.10.15 was tested and confirmed as vulnerable, status of other versions is unknown since this issue was not addressed by a patch.

CWE	CWE-79
Vendor	logseq
Product	logseq
Published	Jun 9, 2026
Last Updated	Jun 9, 2026

Stay Ahead of the Next One

Get instant alerts for logseq logseq

Be the first to know when new unknown vulnerabilities affecting logseq logseq are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

logseq / logseq

0 ≤ 0.10.15

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cert.pl: https://cert.pl/en/posts/2026/06/CVE-2026-9279/ logseq.com: https://logseq.com/

Credits

Bartłomiej Dmitruk (striga.ai)