Executive Summary

CVE-2026-47900 is a stored cross-site scripting (XSS) vulnerability in Logseq software affecting all versions up to and including 0.10.15.

A malicious plugin can insert a JavaScript payload into the "name" field of its package.json file.

This name field is rendered using innerHTML without proper sanitization, which allows the malicious JavaScript code to execute in the privileged host context.

This means an attacker who can install plugins can inject malicious scripts that run with elevated privileges.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker who can install plugins to execute arbitrary code within the privileged host context.

As a result, the attacker could compromise the system by running malicious scripts, potentially leading to data theft, unauthorized actions, or system manipulation.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by inspecting installed plugins for malicious JavaScript payloads in the "name" field of their package.json files. Since the issue arises from the rendering of this field using innerHTML without sanitization, checking plugin package.json files for suspicious or unexpected script content is essential.

There are no specific commands provided in the available resources to detect this vulnerability automatically.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include avoiding the installation of untrusted or unknown plugins, as the vulnerability requires an attacker to install a malicious plugin.

Since no patch addressing this issue is available and only version 0.10.15 was confirmed vulnerable, consider restricting plugin installation or usage until a fix is released.

Useful 0 Not Useful 0