CVE-2026-47901

UNKNOWN 0.0

Iframe escape by plugins in Logseq

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Logseq is vulnerable to a sandbox escape flaw where plugins running in sandboxed iframes can inject arbitrary HTML attributes, such as event handlers, into their container element in the host DOM. Due to a disabled Content Security Policy (CSP), this allows a malicious plugin to execute arbitrary JavaScript in the privileged host context, potentially gaining unauthorized access to filesystem APIs. While only version v0.10.15 was tested and confirmed as vulnerable, status of other versions is unknown since this issue was not addressed by a patch.

CWE	CWE-79
Vendor	logseq
Product	logseq
Published	Jun 9, 2026
Last Updated	Jun 9, 2026

Stay Ahead of the Next One

Get instant alerts for logseq logseq

Be the first to know when new unknown vulnerabilities affecting logseq logseq are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

logseq / logseq

0 ≤ 0.10.15

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cert.pl: https://cert.pl/en/posts/2026/06/CVE-2026-9279/ logseq.com: https://logseq.com/

Credits

Bartłomiej Dmitruk (striga.ai)