CVE-2026-47899: Arbitrary File Read, Write, Rename, and Delete in Logseq
The Electron preload script in Logseq exposes an API method that allows the renderer process to invoke IPC handlers without proper path validation. An attacker with JavaScript execution in the renderer (e.g. via XSS or a malicious plugin), can read, write, or delete arbitrary files on the user's system. While only version v0.10.15 was tested and confirmed as vulnerable, status of other versions is unknown since this issue was not addressed by a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable third-party or untrusted plugins in Logseq until an upstream patch or official fix is available (do not enable plugins from untrusted sources).
Logseq third-party plugins = disabled - Compensating control
Run Logseq in an isolated environment (VM or sandbox) and restrict access to sensitive filesystem locations; avoid opening untrusted content or pages that could supply JavaScript to the renderer.
- Operational
Inspect the filesystem for unexpected reads/writes/deletions and restore affected files from known-good backups. If sensitive files or secrets may have been exposed, rotate those credentials and secrets.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47899?
CVE-2026-47899 has a severity rating of 8.7, classified as high.
How do I fix CVE-2026-47899?
To fix CVE-2026-47899, ensure that you update Logseq to the latest version where this vulnerability is patched.
What type of vulnerability is CVE-2026-47899?
CVE-2026-47899 is classified as an Arbitrary File Read, Write, Rename, and Delete vulnerability.
What are the potential impacts of CVE-2026-47899?
The potential impacts of CVE-2026-47899 include unauthorized access to sensitive files, which can lead to data loss or exposure.
Who is affected by CVE-2026-47899?
Users of Logseq, particularly those using the Electron preload script, are affected by CVE-2026-47899.