CVE-2026-47901: Iframe escape by plugins in Logseq
Logseq is vulnerable to a sandbox escape flaw where plugins running in sandboxed iframes can inject arbitrary HTML attributes, such as event handlers, into their container element in the host DOM. Due to a disabled Content Security Policy (CSP), this allows a malicious plugin to execute arbitrary JavaScript in the privileged host context, potentially gaining unauthorized access to filesystem APIs. While only version v0.10.15 was tested and confirmed as vulnerable, status of other versions is unknown since this issue was not addressed by a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable and enforce a strict Content Security Policy on the host to prevent plugin-provided content from executing inline scripts or event-handler attributes in the privileged host context.
Logseq (host application) Content-Security-Policy = enabled - Configuration
Prevent plugin iframes from injecting arbitrary HTML attributes into their container elements (for example, do not copy or apply attributes from plugin iframe content into host DOM). Ensure host does not expose privileged APIs to iframe-supplied attributes.
Logseq plugin iframe handling plugin_iframe_container_attribute_binding = disallow plugin-supplied attributes - Compensating control
Disable or block third-party/untrusted plugins until a fix is available; restrict plugin installation to trusted sources and enforce code review for plugins that require elevated privileges.
- Operational
Audit all installed plugins for suspicious or untrusted code, remove any untrusted or unnecessary plugins, and review/restrict the application's filesystem API permissions and file system access for the Logseq process.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47901?
CVE-2026-47901 has a medium severity rating of 4.6 according to the CVSS scoring system.
How do I fix CVE-2026-47901?
To mitigate CVE-2026-47901, ensure that your Logseq instance is updated to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-47901?
CVE-2026-47901 is classified as a sandbox escape flaw leading to cross-site scripting (XSS) vulnerabilities.
What software is affected by CVE-2026-47901?
The affected software is Logseq, specifically its plugin system that utilizes sandboxed iframes.
When was CVE-2026-47901 published?
CVE-2026-47901 was published on June 9, 2026.