Executive brief
Logseq, a popular open-source knowledge management and note-taking application, contains a security flaw in how it handles internal communications. If an attacker manages to run malicious code within the app—for example, through a compromised plugin or a separate web-based attack—they could bypass security restrictions to read, modify, or delete any file on your computer. This could lead to the theft of sensitive personal notes or the destruction of important data.
Technical details
The vulnerability exists within Logseq's Electron preload script, which improperly exposes an API method to the renderer process. This method allows the invocation of Inter-Process Communication (IPC) handlers without sufficient path validation. An attacker who achieves JavaScript execution within the renderer process—potentially via a Cross-Site Scripting (XSS) vulnerability or a malicious third-party plugin—can leverage this exposed method to perform unauthorized file operations. Specifically, the attacker can read, write, or delete arbitrary files with the privileges of the Logseq application. As of the advisory date, no patch has been released by the vendor.
Affected products
- Logseq Logseq All through 0.10.15
Timeline
- 2026-06-09: disclosed: Vulnerability disclosed by CERT Polska
- 2026-06-09: advisory