Executive brief
Logseq, a popular open-source knowledge management and note-taking application, contains a security flaw in how it handles third-party plugins. A malicious plugin could bypass security restrictions to run unauthorized code on a user's computer. This could allow an attacker to access, modify, or delete private files and data stored on the local system.
Technical details
Logseq is vulnerable to a sandbox escape (CWE-79) within its plugin architecture. Plugins running in sandboxed iframes can inject arbitrary HTML attributes, such as event handlers, into their container element in the host DOM. Because the Content Security Policy (CSP) is disabled, this allows a malicious plugin to execute arbitrary JavaScript within the privileged host context. An attacker can leverage this to gain unauthorized access to sensitive filesystem APIs. The vulnerability was confirmed in version 0.10.15 and is reported to affect all versions through that release, as no patch has been issued by the vendor.
Affected products
- Logseq Logseq All through 0.10.15
Timeline
- 2026-06-09: disclosed: Vulnerability disclosed by CERT Polska
- 2026-06-09: advisory