CVE-2026-47900
MEDIUMCVSS v4.0: 4.6
Source data as of:
At a glance
- Severity
- MEDIUM
- CVSS
- 4.6 v4.0 · NVD
- EPSS
- EPSS not provided by FIRST.org for this CVE
- CISA KEV
- No
- Type
- XSS · NVD CWE
- Attack conditions (CVSS vector)
- No privileges · Source: NVD Vector
- Published
- 2026-06-09 · Modified: 2026-06-09
- References
- Jump to references (2)
CVSS / EPSS / KEV
Source — CVSS: NVD · EPSS: FIRST.org · KEV: CISA. Data & Sources
Description
Logseq is vulnerable to a stored cross-site scripting (XSS). A malicious plugin can include a JavaScript payload in the "name" field of its "package.json" file, which is rendered using "innerHTML" without proper sanitization, allowing the execution of arbitrary code in the privileged host context. While only version v0.10.15 was tested and confirmed as vulnerable, status of other versions is unknown since this issue was not addressed by a patch.
References
Reference URLs as listed by NVD, grouped by a mechanical match on the link's host/pattern. Labels describe the link type only.
- Reference https://cert.pl/en/posts/2026/06/CVE-2026-9279/
- Reference https://logseq.com/