Quick answers
- Is CVE-2026-9279 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-9279 being exploited in the wild.
- How severe is CVE-2026-9279?
- Informational severity, with a CVSS score of 8.7, published 9 June 2026.
- Which products and versions are affected?
- Logseq All through 0.10.15.
- Is there a fix for CVE-2026-9279?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-9279 attacked?
- It is attacked with local access, in a network appliance.
- Am I affected by CVE-2026-9279?
- Check whether you run Logseq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Logseq exposes an IPC handler that allows the renderer process to execute shell commands. While the application employs an allowlist for specific command names (such as git, pandoc, and grep), it fails to properly sanitize the argument strings. These arguments are concatenated with the command and passed to 'child_process.spawn' with the 'shell: true' option enabled. This configuration allows an attacker to use shell metacharacters to bypass the allowlist and execute arbitrary commands. Exploitation requires the ability to execute JavaScript within the renderer process, which can be achieved via Cross-Site Scripting (XSS) or a malicious plugin. As of the advisory date, no patch has been released by the vendor.
Affected products
- Logseq Logseq All through 0.10.15
Timeline
- 2026-06-09: disclosed: Vulnerability disclosed by CERT Polska
- 2026-06-09: advisory: NVD record published