PT-2026-47800
CVE-2026-47901
·
Published
2026-06-09
·
Updated
2026-06-09
Description by
CVSS 4.0
4.6
MediumMetricsAV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Logseq version 0.10.15
Description
A sandbox escape flaw allows plugins running in sandboxed iframes to inject arbitrary HTML attributes, such as event handlers, into their container element in the host DOM. Because the Content Security Policy (CSP)—a security layer that helps detect and mitigate certain types of attacks—is disabled, a malicious plugin can execute arbitrary JavaScript within the privileged host context. This may lead to unauthorized access to filesystem APIs.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾