CVE-2026-47900: Stored XSS via Unsanitized Plugin Metadata in Logseq
Logseq is vulnerable to a stored cross-site scripting (XSS). A malicious plugin can include a JavaScript payload in the "name" field of its "package.json" file, which is rendered using "innerHTML" without proper sanitization, allowing the execution of arbitrary code in the privileged host context. While only version v0.10.15 was tested and confirmed as vulnerable, status of other versions is unknown since this issue was not addressed by a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Logseq plugin(s)from your environment.Uninstall any untrusted or unknown plugins. Remove locally installed plugins that were not obtained from a verified/trusted source.
- Configuration
Disable loading of third‑party plugins or disable the plugin system entirely until an official fix is available. If disabling is not possible, restrict plugin loading to a vetted/trusted plugin directory or signed plugins only.
Logseq plugin system plugin loading = disabled - Compensating control
Run Logseq in a sandboxed or isolated environment (e.g., container, VM, or OS-level sandbox) and restrict its filesystem and network access to limit impact of arbitrary code execution from malicious plugins.
- Operational
Audit installed plugins' package.json files (especially the "name" field) for unexpected HTML/JavaScript. Disable or remove plugins with suspicious metadata and restart Logseq after removals. Avoid installing plugins from untrusted sources until an official patch is released.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47900?
The severity of CVE-2026-47900 is rated as medium with a score of 4.6.
How do I fix CVE-2026-47900?
To mitigate CVE-2026-47900, ensure that any plugins and their metadata are properly sanitized before rendering.
What type of vulnerability is CVE-2026-47900?
CVE-2026-47900 is a stored cross-site scripting (XSS) vulnerability.
When was CVE-2026-47900 published?
CVE-2026-47900 was published on June 9, 2026.
Which software is affected by CVE-2026-47900?
The vulnerability CVE-2026-47900 affects the Logseq application.