CVE-2026-47899

The record

The Electron preload script in Logseq exposes an API method that allows the renderer process to invoke IPC handlers without proper path validation. An attacker with JavaScript execution in the renderer (e.g. via XSS or a malicious plugin), can read, write, or delete arbitrary files on the user's system. While only version v0.10.15 was tested and confirmed as vulnerable, status of other versions is unknown since this issue was not addressed by a patch.

Affected packages

Related vulnerabilities

• CVE-2026-20293 A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation… CWE-749
• CVE-2026-86711 electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron… CWE-749
• CVE-2026-52877 Streambert is a cross-platform Electron Desktop App to stream and download video content. CWE-749
• CVE-2026-48056 Streambert is a cross-platform Electron Desktop App to stream and download video content. CWE-749
• CVE-2026-20467 In apusys, there is a possible escalation of privilege due to a missing bounds check. CWE-749
• CVE-2026-45489 Microsoft Edge (Chromium-based) Spoofing Vulnerability CWE-749
• CVE-2026-14620 webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints… CWE-749
• CVE-2026-54753 Nx is a monorepo solution for TypeScript and polyglot codebases. CWE-749