CVE-2026-9279

Logseq exposes an IPC handler that allows the renderer process to execute shell commands. While an allowlist restricts the command name (e.g. `git`, `pandoc`, `grep`), the argument string is concatenated with the command and passed to `child_process.spawn` with the `shell: true` option, allowing shell metacharacters in the arguments to bypass the allowlist. An attacker with JavaScript execution in the renderer (e.g. via XSS or a malicious plugin) can execute arbitrary shell commands with the privileges of the Logseq process, leading to remote code execution on the host. While only version v0.10.15 was tested and confirmed as vulnerable, status of other versions is unknown since this issue was not addressed by a patch.

• CWE-78

• https://cert.pl/en/posts/2026/06/CVE-2026-9279/
• https://logseq.com/

Published

Jun 9, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-92784@refinedev/inferencer through 7.0.0 fails to escape API fiel…7.5
• CVE-2026-92785Angel through 3.3.0 deserializes untrusted setAlgoMetrics pa…8.1
• CVE-2026-92786LightGBM through 4.7.0 fails to validate child and split arr…7.8
• CVE-2026-92787Feast through 0.66.0 fails to verify JWT token signatures be…9.8
• CVE-2026-92788Coze Studio through 0.5.1 fails to validate that table names…8.8
• CVE-2026-92789Graylog through 7.1.4 validates outbound URLs against an all…6.5
• CVE-2026-92790Higress before 2.2.4 panics when processing a Cookie header …6.5
• CVE-2026-92791Uber Kraken through 0.1.29 fails to validate the tag paramet…7.5
• CVE-2026-92792OpenNHP through 1.0.2 selects its trusted-execution attestat…7.5
• CVE-2026-92793GoAdmin through 1.2.26 fails to properly anchor the logout p…8.1
• CVE-2026-92794OpenSign through 2.41.3 fails to validate caller identity in…7.5
• CVE-2026-92795Coze Studio through 0.5.1 fails to restrict the server URL s…6.5