CVE-2026-9279— Logseq 操作系统命令注入漏洞

Shell command injection in Logseq

Logseq exposes an IPC handler that allows the renderer process to execute shell commands. While an allowlist restricts the command name (e.g. `git`, `pandoc`, `grep`), the argument string is concatenated with the command and passed to `child_process.spawn` with the `shell: true` option, allowing shell metacharacters in the arguments to bypass the allowlist. An attacker with JavaScript execution in the renderer (e.g. via XSS or a malicious plugin) can execute arbitrary shell commands with the privileges of the Logseq process, leading to remote code execution on the host. While only version v0.10.15 was tested and confirmed as vulnerable, status of other versions is unknown since this issue was not addressed by a patch.

N/A

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Logseq 操作系统命令注入漏洞

Logseq是Logseq开源的一个知识管理和协作平台。 Logseq v0.10.15版本存在操作系统命令注入漏洞，该漏洞源于IPC处理程序允许渲染器进程执行shell命令，且参数拼接时未充分过滤shell元字符，可能导致攻击者通过JavaScript执行绕过白名单并执行任意shell命令，导致远程代码执行。

N/A

N/A