CVE-2026-47900

Name of the Vulnerable Software and Affected Versions Logseq version 0.10.15

Description A stored cross-site scripting (XSS) issue exists where a malicious plugin can include a JavaScript payload in the name field of its package.json file. This occurs because the field is rendered using innerHTML without proper sanitization, enabling the execution of arbitrary code within the privileged host context.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.