Sandbox Escape via CSP Bypass in Logseq

Mitigation Strategies

Since the vulnerability arises from plugins running in sandboxed iframes injecting arbitrary HTML attributes due to a disabled Content Security Policy (CSP), immediate mitigation steps include:

• Avoid installing or running untrusted or unknown plugins in Logseq.
• Disable or remove any suspicious plugins that might have been installed.
• Consider restricting plugin installation permissions or running Logseq in a more isolated environment.
• Monitor for updates or patches from Logseq that address this vulnerability and apply them once available.

Useful 0 Not Useful 0

Executive Summary

This vulnerability in Logseq involves a sandbox escape flaw where plugins running inside sandboxed iframes can inject arbitrary HTML attributes, including event handlers, into their container element within the host DOM.

Because the Content Security Policy (CSP) is disabled, a malicious plugin can exploit this to execute arbitrary JavaScript code in the privileged host context.

This allows the attacker to potentially gain unauthorized access to filesystem APIs, which should normally be restricted.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow a malicious plugin to execute arbitrary JavaScript code with elevated privileges in the host environment.

This could lead to unauthorized access to filesystem APIs, potentially exposing or modifying sensitive files on the user's system.

Such unauthorized access can compromise the confidentiality and integrity of user data.

Useful 0 Not Useful 0