Logseq RCE via shell injection and sandbox escape
Four critical vulnerabilities in Logseq allow arbitrary code execution via shell metacharacter injection, path traversal, and XSS-based sandbox escapes.
CERT Polska disclosed four vulnerabilities in the Logseq knowledge management application that enable remote code execution. CVE-2026-9279 is a shell injection flaw where an IPC handler executes commands with shell: true, allowing attackers with renderer JavaScript access to bypass command allowlists using shell metacharacters. CVE-2026-47899 permits arbitrary file read/write/delete via an improperly validated IPC API. CVE-2026-47900 and CVE-2026-47901 are XSS and sandbox escape flaws respectively, both allowing malicious plugins to execute code in the privileged host context.
Exploitation requires JavaScript execution in the renderer process, achievable through XSS or a malicious plugin. Version 0.10.15 was confirmed vulnerable; the status of other versions is unknown as the vendor has not addressed these issues. The vulnerabilities were responsibly disclosed by security researcher Bartłomiej Dmitruk from striga.ai and coordinated through CERT Polska's disclosure process.
Organizations using Logseq should assess their exposure, particularly in environments where untrusted plugins may be installed or where user-controlled content could introduce XSS vectors. No patches or mitigations have been announced by the vendor.
Mentioned in this report
Detection guidance
Logseq Spawns Windows Shell Interpreter with Shell Metacharacters
Detects Logseq's Electron main process spawning cmd.exe or powershell.exe with shell metacharacters in the command line, consistent with CVE-2026-9279 shell-injection RCE via the shell:true IPC handler. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Logseq Spawns Shell with Injection Metacharacters (Windows)
id: 14b05a70-c6b3-58f0-847e-59a39e20e06b
status: experimental
description: Detects Logseq spawning a Windows command interpreter with shell metacharacters
in the command line, matching the CVE-2026-9279 shell injection pattern where a
privileged IPC handler executes commands via shell:true, allowing renderer JavaScript
to bypass command allowlists.
references:
- CERT Polska Logseq RCE disclosure
author: Vorant
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains: Logseq
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
metachars:
CommandLine|contains:
- '&&'
- '||'
- ;
- '|'
- '`'
- $(
- '>'
- <
filter_benign:
CommandLine|contains:
- Logseq\resources
condition: selection and metachars and not filter_benign
falsepositives:
- Legitimate Logseq plugins that shell out to git or pandoc with complex quoting
- Administrative scripting tools that happen to launch from a Logseq-named working
directory
level: high
tags:
- attack.t1059.004
- attack.t1203
- cve.2026-9279
Logseq Spawns Unix Shell with Injection Metacharacters
Detects Logseq's Electron main process on Linux/macOS spawning /bin/sh or /bin/bash with shell metacharacters, consistent with exploitation of the CVE-2026-9279 shell:true IPC handler. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Logseq Spawns Unix Shell with Injection Metacharacters
id: 19ae9b3c-69c3-5ffd-83d1-55ab94f7930b
status: experimental
description: Detects Logseq spawning a Unix shell interpreter (sh, bash, zsh) with
shell metacharacters in the command line, matching the CVE-2026-9279 shell injection
pattern where renderer-controlled JavaScript reaches a privileged IPC handler invoking
commands via shell:true, bypassing allowlist checks with metacharacters.
references:
- CERT Polska Logseq RCE disclosure
author: Vorant
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains: Logseq
Image|endswith:
- /sh
- /bash
- /zsh
- /dash
metachars:
CommandLine|contains:
- '&&'
- '||'
- ;
- '|'
- '`'
- $(
condition: selection and metachars
falsepositives:
- Legitimate Logseq plugins invoking shell pipelines for git, pandoc, or file conversion
- Developer testing of Logseq plugin scripts from a build directory named Logseq
level: high
tags:
- attack.t1059.004
- attack.t1203
- cve.2026-9279
Logseq Electron Process Spawns Unexpected Child Interpreter Following Renderer Compromise
Detects Logseq (an Electron knowledge-management app that should rarely spawn command interpreters) creating a shell or scripting process as a direct child, indicating possible exploitation of XSS/plugin sandbox-escape flaws (CVE-2026-47900/47901) leading to code execution in the privileged host context. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Logseq Electron App Spawns Command Interpreter Child Process
id: 8ae49baf-b88c-5438-a072-c2c1e2987f6e
status: experimental
description: Detects the Logseq Electron application spawning a shell or scripting
interpreter as a direct child process. Logseq's normal operation rarely requires
spawning shells directly from its main process; this pattern is consistent with
sandbox escape or XSS-driven exploitation (CVE-2026-47900, CVE-2026-47901) that
achieves code execution in the privileged Electron host context, or shell injection
via the vulnerable IPC handler (CVE-2026-9279).
references:
- CERT Polska Logseq RCE disclosure
author: Vorant
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains: Logseq
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
filter_known_plugins:
CommandLine|contains:
- --version
condition: selection and not filter_known_plugins
falsepositives:
- Logseq plugins that legitimately shell out to helper CLI tools for export or git
sync
- Update or diagnostic scripts bundled with Logseq that invoke PowerShell for version
checks
level: medium
tags:
- attack.t1203
- attack.t1059.007
- cve.2026-47900
- cve.2026-47901
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-9279/
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free