Executive brief
Logseq, an open-source knowledge management and note-taking application, contains a security flaw that allows for unauthorized command execution. If an attacker can run malicious code within the app—for example, through a compromised plugin or a malicious note—they can take full control of the user's computer. This could lead to the theft of private notes, personal files, or the installation of malware.
Technical details
Logseq exposes an IPC handler that allows the renderer process to execute shell commands. While the application employs an allowlist for specific command names (such as git, pandoc, and grep), it fails to properly sanitize the argument strings. These arguments are concatenated with the command and passed to 'child_process.spawn' with the 'shell: true' option enabled. This configuration allows an attacker to use shell metacharacters to bypass the allowlist and execute arbitrary commands. Exploitation requires the ability to execute JavaScript within the renderer process, which can be achieved via Cross-Site Scripting (XSS) or a malicious plugin. As of the advisory date, no patch has been released by the vendor.
Affected products
- Logseq Logseq All through 0.10.15
Timeline
- 2026-06-09: disclosed: Vulnerability disclosed by CERT Polska
- 2026-06-09: advisory: NVD record published