Quick answers
- Is CVE-2026-124573 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-124573 being exploited in the wild.
- How severe is CVE-2026-124573?
- High severity, with a CVSS score of 7.3, published 9 November 2026.
- Which products and versions are affected?
- Logseq 2.0.1, 2.0.2.
- Is there a fix for CVE-2026-124573?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-124573 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-124573?
- Check whether you run Logseq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Local HTTP API server (Fastify on 127.0.0.1:12315) skips authentication entirely when the token list is empty (default state) due to a short-circuit in the when-let conditional. CORS is enabled with allow-origin *, allowing cross-origin requests from any website. An attacker can chain the unauthenticated writeDotdirFile function with directory traversal in the subRoot parameter to write arbitrary files (including executables) to any location under the user's home directory, then execute them via file: protocol or Windows Startup folder persistence. The attack vector is network/remote and requires only that the victim has Logseq running with the API server started and visits an attacker-controlled webpage.
Affected products
- Logseq Logseq 2.0.1, 2.0.2
Timeline
- 2026-11-09: disclosed