CVE-2026-9279
HighCVSS 8.7Summary
Logseq exposes an IPC handler that allows the renderer process to execute shell commands. While an allowlist restricts the command name, the argument string can contain shell metacharacters, allowing them to bypass the allowlist.
Risk Assessment
An attacker with JavaScript execution in the renderer can execute arbitrary shell commands with the privileges of the Logseq process, leading to remote code execution on the host.
Recommendation
It is recommended to update Logseq to the latest version and to monitor and restrict access to rendering processes to minimize the risk of attacks.
Original NVD description (English source)
Logseq exposes an IPC handler that allows the renderer process to execute shell commands. While an allowlist restricts the command name (e.g. `git`, `pandoc`, `grep`), the argument string is concatenated with the command and passed to `child_process.spawn` with the `shell: true` option, allowing shell metacharacters in the arguments to bypass the allowlist. An attacker with JavaScript execution in the renderer (e.g. via XSS or a malicious plugin) can execute arbitrary shell commands with the privileges of the Logseq process, leading to remote code execution on the host. While only version v0.10.15 was tested and confirmed as vulnerable, status of other versions is unknown since this issue was not addressed by a patch.