Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Electron preload script in Logseq exposes an API method that allows the renderer process to invoke IPC handlers without proper path validation. An attacker with JavaScript execution in the renderer (e.g. via XSS or a malicious plugin), can read, write, or delete arbitrary files on the user's system. While only version v0.10.15 was tested and confirmed as vulnerable, status of other versions is unknown since this issue was not addressed by a patch.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-47899 Arbitrary File Access via Unvalidated IPC Handler in Logseq Electron Preload Script https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-47899
Post summary
A newly disclosed CVE in Logseq’s Electron preload script allows arbitrary file access via an unvalidated IPC handler.
Vulnerabilities in Logseq software https://ift.tt/uOy7jEi CERT Polska has received a report about 4 vulnerabilities (CVE-2026-9279 and from CVE-2026-47899 to CVE-2026-47901) found in Logseq software. Introduction to Malware Binary Triage (IMBT) Course Looking to level up yo…
Post summary
CERT Polska announced that four Logseq software vulnerabilities (CVE-2026-9279, CVE-2026-47899 to CVE-2026-47901) have been identified, without providing exploit details or patches.