Logseq plugin flaws chain to RCE
Four vulnerabilities in Logseq allow malicious plugins or XSS to escape the sandbox and achieve remote code execution.
CERT Polska coordinated disclosure of four vulnerabilities in the Logseq note-taking application, all stemming from insufficient isolation between the Electron renderer process and privileged host capabilities. CVE-2026-9279 involves an IPC handler that passes user-supplied arguments to child_process.spawn with shell:true, allowing shell metacharacters to bypass a command allowlist and achieve arbitrary command execution. CVE-2026-47899 exposes an Electron preload API that lacks path validation, enabling arbitrary file read/write/delete. CVE-2026-47900 is a stored XSS triggered by an unsanitized plugin package.json name field rendered via innerHTML. CVE-2026-47901 allows sandboxed plugin iframes to inject HTML event-handler attributes into the host DOM, bypassing a disabled CSP to execute JavaScript in the privileged host context.
Exploitation of any of these requires an attacker to first obtain JavaScript execution in the renderer, typically via a malicious plugin or an XSS vector, after which the chain escalates to full host-level code execution, filesystem access, or a sandbox escape. Only version v0.10.15 was confirmed vulnerable, and the vendor has not addressed the sandbox escape issue (CVE-2026-47901) at time of publication. The report credits researcher Bartłomiej Dmitruk (striga.ai) for responsible disclosure through CERT Polska's coordinated vulnerability disclosure process.
Mentioned in this report
Detection guidance
Logseq Electron Process Spawning Command Shell Interpreter
Detects Logseq spawning cmd.exe, powershell.exe, sh or bash as a child process, consistent with exploitation of the child_process.spawn(shell:true) IPC handler flaw (CVE-2026-9279). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Logseq Spawning Shell Interpreter Child Process
id: 247666b5-30ef-510a-938a-c26a82a04322
status: experimental
description: Detects Logseq (Electron note-taking app) launching a command interpreter
as a child process, which is atypical for normal note-taking/plugin operation and
consistent with exploitation of an IPC handler that passes user input to child_process.spawn
with shell:true (CVE-2026-9279).
references:
- CERT Polska coordinated disclosure - Logseq plugin RCE chain
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \Logseq.exe
- \logseq.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \sh.exe
- \bash.exe
filter:
CommandLine|contains:
- --version
- --help
condition: selection and not filter
falsepositives:
- Legitimate Logseq plugins that intentionally shell out to git or pandoc for document
conversion
- Developer debugging sessions launching a shell from Logseq's dev tools
level: high
tags:
- attack.t1059
- attack.t1189
author: Vorant
Logseq Child Process Command Line Containing Shell Metacharacters
Detects shell metacharacters (chaining, substitution, backticks) in command lines of processes spawned by Logseq, indicative of allowlist bypass in the IPC command execution handler (CVE-2026-9279). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Metacharacter Command Injection From Logseq Child Process
id: eca8daa2-e2bb-5a0a-af86-b022552a88ee
status: experimental
description: Detects command lines launched by processes spawned from Logseq that
contain shell metacharacters (;, |, &, $(), backticks) used to escape a command
allowlist when Logseq passes user-supplied plugin/IPC arguments to child_process.spawn
with shell:true (CVE-2026-9279).
references:
- CERT Polska coordinated disclosure - Logseq plugin RCE chain
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \Logseq.exe
- \logseq.exe
metachar:
CommandLine|contains:
- ;
- '&&'
- '||'
- '|'
- '`'
- $(
- '>%TEMP%'
condition: selection and metachar
falsepositives:
- Legitimate plugin scripts that build multi-argument shell pipelines for file conversion
utilities
level: high
tags:
- attack.t1027
- attack.t1059
author: Vorant
Logseq Process Writing or Deleting Files Outside Plugin Data Directory
Detects Logseq performing file write/delete operations to sensitive OS or user profile paths outside its own plugin/data directories, consistent with abuse of an unvalidated Electron preload file API (CVE-2026-47899). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Logseq Arbitrary File Write Outside Application Directory
id: 1f47d9c1-155a-5619-a649-ff505a88b38d
status: experimental
description: Detects file write or delete events performed by the Logseq process targeting
locations outside its expected application/plugin data directories (e.g. system
folders, other users' profiles, startup folders), consistent with exploitation of
an Electron preload API lacking path validation that allows arbitrary file read/write/delete
(CVE-2026-47899).
references:
- CERT Polska coordinated disclosure - Logseq plugin RCE chain
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \Logseq.exe
- \logseq.exe
suspicious_target:
TargetFilename|contains:
- \Windows\System32\
- \Windows\SysWOW64\
- \Startup\
- \Users\Public\
- \AppData\Roaming\Microsoft\Windows\Start Menu\
filter:
TargetFilename|contains:
- \AppData\Roaming\Logseq\
- \.logseq\
condition: selection and suspicious_target and not filter
falsepositives:
- Logseq auto-update mechanism writing to legitimate application install paths
- Backup or sync plugins intentionally configured to write to shared public folders
level: medium
tags:
- attack.t1055
- attack.t1189
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-9279
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free