CVE-2026-47899

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47899
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47899.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47899
Published
2026-06-09T13:23:44.532Z
Modified
2026-07-08T08:13:39.934478913Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N CVSS Calculator
Summary
Arbitrary File Read, Write, Rename, and Delete in Logseq
Details

The Electron preload script in Logseq exposes an API method that allows the renderer process to invoke IPC handlers without proper path validation. An attacker with JavaScript execution in the renderer (e.g. via XSS or a malicious plugin), can read, write, or delete arbitrary files on the user's system. While only version v0.10.15 was tested and confirmed as vulnerable, status of other versions is unknown since this issue was not addressed by a patch.

Database specific 
{
    "cna_assigner": "CERT-PL",
    "cwe_ids": [
        "CWE-749"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47899.json"
}
References

Affected packages

Git / github.com/logseq/logseq

Affected ranges

Type
GIT
Repo
https://github.com/logseq/logseq
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
03bcefbdf87458f87499abb988ac3b9fac2c07d8
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.10.15"
        }
    ]
}

Affected versions

0.*
0.0.1-10
0.0.1-100
0.0.1-11
0.0.1-13
0.0.1-14
0.0.1-15
0.0.1-18
0.0.1-19
0.0.1-2
0.0.1-20
0.0.1-21
0.0.1-3
0.0.1-4
0.0.1-7
0.0.1-9
0.0.10
0.0.11
0.0.12
0.0.13
0.0.14
0.0.15
0.0.16
0.0.17
0.0.18
0.0.19
0.0.2.0
0.0.2.1
0.0.2.2
0.0.2.3
0.0.2.5
0.0.2.7
0.0.2.8
0.0.2.9
0.0.20
0.0.3.0
0.0.3.1
0.0.3.2
0.0.3.4
0.0.3.5
0.0.3.7
0.0.3.8
0.0.3.9
0.0.4.0
0.0.4.1
0.0.4.3
0.0.5.1
0.0.5.2
0.0.5.3
0.0.6
0.0.6.0
0.0.7
0.0.8
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.10.0
0.10.1
0.10.10
0.10.11
0.10.11-rc1
0.10.12
0.10.13
0.10.14
0.10.15
0.10.2
0.10.3
0.10.4
0.10.5
0.10.6
0.10.7
0.10.8
0.10.9
0.2.0
0.2.1
0.2.10
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.3.5
0.3.6
0.3.6-pre-release
0.3.7
0.3.8
0.3.9
0.4.0
0.4.0-perf
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.8
0.5.9
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.6.9
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.0
0.8.1
0.8.10
0.8.11
0.8.12
0.8.13
0.8.14
0.8.15
0.8.16
0.8.18
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
Other
github-action-repro
nightly
mobile-0.*
mobile-0.1
mobile-0.1.1
v0.*
v0.0.1-1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47899.json"