Vulnerabilities in Logseq software

CERT Polska coordinated disclosure of four vulnerabilities in Logseq (through v0.10.15): an IPC handler command-injection leading to remote code execution (CVE-2026-9279), an insecure IPC/preload API allowing arbitrary file read/write/delete (CVE-2026-47899), a stored XSS via plugin package.json name rendering (CVE-2026-47900), and a sandbox escape due to disabled CSP allowing privileged JS execution (CVE-2026-47901). The flaws can be triggered by malicious plugins or renderer JavaScript (e.g., XSS) and grant attacker control or filesystem access under the Logseq process; disclosure credited to Bartłomiej Dmitruk and coordinated by CERT Polska.