CVE-2026-9279

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-9279
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9279.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-9279
Published
2026-06-09T13:23:41.892Z
Modified
2026-07-15T01:48:52.075700552Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N CVSS Calculator
Summary
Shell command injection in Logseq
Details

Logseq exposes an IPC handler that allows the renderer process to execute shell commands. While an allowlist restricts the command name (e.g. git, pandoc, grep), the argument string is concatenated with the command and passed to child_process.spawn with the shell: true option, allowing shell metacharacters in the arguments to bypass the allowlist. An attacker with JavaScript execution in the renderer (e.g. via XSS or a malicious plugin) can execute arbitrary shell commands with the privileges of the Logseq process, leading to remote code execution on the host. While only version v0.10.15 was tested and confirmed as vulnerable, status of other versions is unknown since this issue was not addressed by a patch.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9279.json",
    "cwe_ids": [
        "CWE-78"
    ],
    "cna_assigner": "CERT-PL"
}
References

Affected packages

Git / github.com/logseq/logseq

Affected ranges

Type
GIT
Repo
https://github.com/logseq/logseq
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
03bcefbdf87458f87499abb988ac3b9fac2c07d8
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.10.15"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.0.1-10
0.0.1-100
0.0.1-11
0.0.1-13
0.0.1-14
0.0.1-15
0.0.1-18
0.0.1-19
0.0.1-2
0.0.1-20
0.0.1-21
0.0.1-3
0.0.1-4
0.0.1-7
0.0.1-9
0.0.10
0.0.11
0.0.12
0.0.13
0.0.14
0.0.15
0.0.16
0.0.17
0.0.18
0.0.19
0.0.2.0
0.0.2.1
0.0.2.2
0.0.2.3
0.0.2.5
0.0.2.7
0.0.2.8
0.0.2.9
0.0.20
0.0.3.0
0.0.3.1
0.0.3.2
0.0.3.4
0.0.3.5
0.0.3.7
0.0.3.8
0.0.3.9
0.0.4.0
0.0.4.1
0.0.4.3
0.0.5.1
0.0.5.2
0.0.5.3
0.0.6
0.0.6.0
0.0.7
0.0.8
0.0.9
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.10.0
0.10.1
0.10.10
0.10.11
0.10.11-rc1
0.10.12
0.10.13
0.10.14
0.10.15
0.10.2
0.10.3
0.10.4
0.10.5
0.10.6
0.10.7
0.10.8
0.10.9
0.2.0
0.2.1
0.2.10
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.3.5
0.3.6
0.3.6-pre-release
0.3.7
0.3.8
0.3.9
0.4.0
0.4.0-perf
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.8
0.5.9
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.6.9
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.0
0.8.1
0.8.10
0.8.11
0.8.12
0.8.13
0.8.14
0.8.15
0.8.16
0.8.18
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.1
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.2
0.9.20
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
Other
github-action-repro
nightly
mobile-0.*
mobile-0.1
mobile-0.1.1
v0.*
v0.0.1-1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9279.json"