CVE-2026-9279Disclosure

LOWCVSS 8.7 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Logseq exposes an IPC handler that allows the renderer process to execute shell commands. While an allowlist restricts the command name (e.g. `git`, `pandoc`, `grep`), the argument string is concatenated with the command and passed to `child_process.spawn` with the `shell: true` option, allowing shell metacharacters in the arguments to bypass the allowlist. An attacker with JavaScript execution in the renderer (e.g. via XSS or a malicious plugin) can execute arbitrary shell commands with the privileges of the Logseq process, leading to remote code execution on the host. While only version v0.10.15 was tested and confirmed as vulnerable, status of other versions is unknown since this issue was not addressed by a patch.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
General: 1 classified signal
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification2 categories

Disclosure

150.0%

General

150.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Upwind Security MDR@UpwindMDR137d
Disclosure
🚨High - Logseq Command Injection / Renderer-to-RCE (CVE-2026-9279) http://CERT.PL disclosed an OS command injection flaw (CWE-78) in Logseq, the Electron-based note-taking app. Logseq's IPC handler lets the renderer run shell commands. An allowlist limits the command name (git, pandoc, grep), but the arguments are concatenated and passed to child_process.spawn with shell: true, so shell metacharacters in the arguments slip past the allowlist. An attacker who can run JavaScript in the renderer - via XSS in note content or a malicious plugin - can execute arbitrary shell commands as the Logseq process, reaching RCE on the host. Only v0.10.15 was confirmed, and per http://CERT.PL there is no patch yet. 👉No fix is available.
Post summary
A new high‑severity Logseq command injection vulnerability (CVE-2026-9279) is disclosed with technical details; no exploit code or active attacks reported, and currently no patch exists.
00000139
210 followersView on X
Israel@f1tym1137d
General
Vulnerabilities in Logseq software https://ift.tt/uOy7jEi CERT Polska has received a report about 4 vulnerabilities (CVE-2026-9279 and from CVE-2026-47899 to CVE-2026-47901) found in Logseq software. Introduction to Malware Binary Triage (IMBT) Course Looking to level up yo…
Post summary
CERT Polska announced four CVEs affecting Logseq, but the brief statement offers no details on exploitation, patches, or technical specifics.
0000078
993 followersView on X

Explore more

Back to dashboard